CKV2_ANSIBLE_2 false positive when variable is used

[amedee]

Describe the issue CKV2_ANSIBLE_2 gives a false positive when an https url is inside a variable.

Examples Task:

- name: Check if WP-CLI is already installed
  ansible.builtin.stat:
    path: "{{ blog_wpcli_path }}"
  register: wpcli

- name: Download WP-CLI
  when: not wpcli.stat.exists
  become: true
  ansible.builtin.get_url:
    url: "{{ blog_wpcli_url }}"
    dest: "{{ blog_wpcli_path }}"
    owner: root
    mode: u=rwx,go=rx

In vars/main.yml:

---
blog_wpcli_path: /usr/local/bin/wp
blog_wpcli_url: https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar

Expected outcome:

• CKV2_ANSIBLE_2 passes because blog_wpcli_url starts with https.

Actual outcome:

• CKV2_ANSIBLE_2 fails.

Version (please complete the following information):

• Checkov Version: 3.2.79 (the version reported by Codacy)

[tsmithv11]

@amedee we don't yet support variable rendering in Ansible, so until then, I switched the policy to flag the use of http and ftp since URL protocol prefixes are required, the effect should be the same.

[amedee]

Do you mean I put the "https://" prefix hard coded and the rest of the URL in a variable? Kludgy, but I see how that could work. Thanks for the reply.

[tsmithv11]

@amedee not quite - we don't want you to have to change your coding behavior for a security check.

Once that PR is merged, instead of checking that url does start with https://, we'll instead check that id doesn't start with http:// or ftp://. Since we don't do variable rendering yet, we'll see the url value as literally "{{ blog_wpcli_url }}" which doesn't start with http:// or ftp:// so it will pass.

[amedee]

Oh ok I see. Yes that makes more sense.