Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug][FR] Remove Rule Type Change Restriction and Fix Version Lock Bug #2769

Merged
merged 5 commits into from
May 2, 2023
Merged

[Bug][FR] Remove Rule Type Change Restriction and Fix Version Lock Bug #2769

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
021adc6
updated version_lock to remove type restriction
terrancedejesus May 1, 2023
d7bcada
addressing flake errors
terrancedejesus May 1, 2023
aa6076e
reverting version lock and testing rule
terrancedejesus May 1, 2023
8f8b55d
reverting spaces in testing rule
terrancedejesus May 1, 2023
8681f7e
Merge branch 'main' into 2765-fr-remove-rule-type-change-restriction
terrancedejesus May 2, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 5 additions & 12 deletions detection_rules/version_lock.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,15 +208,6 @@ def log_changes(r, route_taken, new_rule_version, *msg):
lock_from_rule = rule.contents.lock_info(bump=not exclude_version_update)
lock_from_file: dict = lock_file_contents.setdefault(rule.id, {})

# prevent rule type changes for already locked and released rules (#1854)
if lock_from_file:
name = lock_from_rule['rule_name']
existing_type = lock_from_file['type']
current_type = lock_from_rule['type']
if existing_type != current_type:
err_msg = f'cannot change "type" in locked rule: {name} from {existing_type} to {current_type}'
raise ValueError(err_msg)

# scenarios to handle, assuming older stacks are always locked first:
# 1) no breaking changes ever made or the first time a rule is created
# 2) on the latest, after a breaking change has been locked
Expand Down Expand Up @@ -244,7 +235,8 @@ def log_changes(r, route_taken, new_rule_version, *msg):
elif min_stack > latest_locked_stack_version:
route = 'B'
# 3) on the latest stack, locking in a breaking change

stripped_latest_locked_stack_version = f"{latest_locked_stack_version.major}." \
f"{latest_locked_stack_version.minor}"
# preserve buffer space to support forked version spacing
if exclude_version_update:
buffer_int -= 1
Expand All @@ -260,14 +252,15 @@ def log_changes(r, route_taken, new_rule_version, *msg):
lock_from_file.setdefault("previous", {})

# move the current locked info into the previous section
lock_from_file["previous"][str(latest_locked_stack_version)] = previous_lock_info
lock_from_file["previous"][stripped_latest_locked_stack_version] = previous_lock_info

# overwrite the "latest" part of the lock at the top level
lock_from_file.update(lock_from_rule, min_stack_version=stripped_version)
new_version = lock_from_rule['version']
log_changes(
rule, route, new_version,
f'previous {latest_locked_stack_version} saved as version: {previous_lock_info["version"]}',
f'previous {stripped_latest_locked_stack_version} saved as \
version: {previous_lock_info["version"]}',
f'current min_stack updated to {stripped_version}'
)

Expand Down