[VISHNU0906]

Overview

Exception patterns are compiled as "^" + pattern + "$". When the pattern uses alternation, the anchors only bind to the first and last alternatives. So namespace: "kube-system|kube-public" becomes ^kube-system|kube-public$, which also matches kube-system-tenant or not-kube-public. The same goes for name, cluster, labels and the case-insensitive framework / control ID / rule name patterns (C-0001|C-0002 also matches C-00012). An exception written for two namespaces ends up hiding findings on resources it was never meant to cover.

This change groups the pattern before anchoring (^(?:pattern)$) in one helper used by both regexCompare and regexCompareI. A pattern that only compiles in the old form keeps its old meaning, so the bare * wildcard that TestGetResourceExceptions relies on still matches everything.

How to Test

• New TestGetResourceExceptions_RegexAlternation goes through GetResourceExceptions with namespace and name alternations (must match each alternative, must not match a longer value).
• New TestListRuleExceptionsRegexAlternation covers control ID alternation through ListRuleExceptions and RegexCompareControlID.
• TestRegexCompare gets cluster / framework alternation cases and a * wildcard check.
• The new tests fail with the comparator change reverted. go test -race ./..., go test ./... -covermode=count and go build ./... pass; golangci-lint reports the same two existing staticcheck findings as on main.

The CRD exception merge in the kubescape CLI (scopeMatcher.covers in core/cautils/getter/mergedexceptionsgetter.go) builds its patterns the same way to mirror this processor. Happy to send the matching change there once this lands.

cc @matthyx

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 55c4c296-cc35-453e-81ca-3c01d15ececc

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[matthyx]

Reviewed head 6ecbcbf against main.

• Need: confirmed. ^a|b$ anchors only the ends, so kube-system|kube-public also matched kube-system-tenant and not-kube-public. Fixing it narrows exceptions that were too broad.
• Soundness: wrapping the pattern as ^(?:…)$ is the correct fix. It is shared by regexCompare and regexCompareI. The fallback to the old form keeps the bare * wildcard working.
• Validation: go test -race ./exceptions/... passes and go vet is clean. With the PR's test file run against the unfixed comparator, TestRegexCompare, TestGetResourceExceptions_RegexAlternation and TestListRuleExceptionsRegexAlternation fail.
• Duplicates: no other open or merged PR covers this. #196 also touches comparator.go, but for a different fix (ephemeral container paths), so a trivial rebase at most.
• Limits: only DCO and GitGuardian ran, with no CI test workflow. I did not run lint.

No blockers. Approving.