Closed amedee closed 1 month ago
@amedee we don't yet support variable rendering in Ansible, so until then, I switched the policy to flag the use of http and ftp since URL protocol prefixes are required, the effect should be the same.
Do you mean I put the "https://" prefix hard coded and the rest of the URL in a variable? Kludgy, but I see how that could work. Thanks for the reply.
@amedee not quite - we don't want you to have to change your coding behavior for a security check.
Once that PR is merged, instead of checking that url does start with https://
, we'll instead check that id doesn't start with http://
or ftp://
. Since we don't do variable rendering yet, we'll see the url value as literally "{{ blog_wpcli_url }}"
which doesn't start with http://
or ftp://
so it will pass.
Oh ok I see. Yes that makes more sense.
Describe the issue
CKV2_ANSIBLE_2
gives a false positive when an https url is inside a variable.Examples Task:
In
vars/main.yml
:Expected outcome:
CKV2_ANSIBLE_2
passes becauseblog_wpcli_url
starts with https.Actual outcome:
CKV2_ANSIBLE_2
fails.Version (please complete the following information):