622 lines
19 KiB
Go
622 lines
19 KiB
Go
/*
|
|
AngelaMos | 2026
|
|
compose.go
|
|
*/
|
|
|
|
package analyzer
|
|
|
|
import (
|
|
"context"
|
|
"os"
|
|
"strconv"
|
|
"strings"
|
|
|
|
"github.com/CarterPerez-dev/docksec/internal/finding"
|
|
"github.com/CarterPerez-dev/docksec/internal/rules"
|
|
"gopkg.in/yaml.v3"
|
|
)
|
|
|
|
type ComposeAnalyzer struct {
|
|
path string
|
|
}
|
|
|
|
func NewComposeAnalyzer(path string) *ComposeAnalyzer {
|
|
return &ComposeAnalyzer{path: path}
|
|
}
|
|
|
|
func (a *ComposeAnalyzer) Name() string {
|
|
return "compose:" + a.path
|
|
}
|
|
|
|
func (a *ComposeAnalyzer) Analyze(
|
|
ctx context.Context,
|
|
) (finding.Collection, error) {
|
|
data, err := os.ReadFile(a.path)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
var root yaml.Node
|
|
if err := yaml.Unmarshal(data, &root); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
target := finding.Target{
|
|
Type: finding.TargetCompose,
|
|
Name: a.path,
|
|
}
|
|
|
|
var findings finding.Collection
|
|
|
|
services := findNode(&root, "services")
|
|
if services == nil {
|
|
return findings, nil
|
|
}
|
|
|
|
for i := 0; i < len(services.Content); i += 2 {
|
|
if i+1 >= len(services.Content) {
|
|
break
|
|
}
|
|
serviceName := services.Content[i].Value
|
|
serviceNode := services.Content[i+1]
|
|
|
|
findings = append(
|
|
findings,
|
|
a.analyzeService(target, serviceName, serviceNode)...)
|
|
}
|
|
|
|
return findings, nil
|
|
}
|
|
|
|
func (a *ComposeAnalyzer) analyzeService(
|
|
target finding.Target,
|
|
serviceName string,
|
|
node *yaml.Node,
|
|
) finding.Collection {
|
|
var findings finding.Collection
|
|
|
|
findings = append(
|
|
findings,
|
|
a.checkPrivileged(target, serviceName, node)...)
|
|
findings = append(
|
|
findings,
|
|
a.checkCapabilities(target, serviceName, node)...)
|
|
findings = append(findings, a.checkVolumes(target, serviceName, node)...)
|
|
findings = append(
|
|
findings,
|
|
a.checkNetworkMode(target, serviceName, node)...)
|
|
findings = append(findings, a.checkPidMode(target, serviceName, node)...)
|
|
findings = append(findings, a.checkIpcMode(target, serviceName, node)...)
|
|
findings = append(
|
|
findings,
|
|
a.checkSecurityOpt(target, serviceName, node)...)
|
|
findings = append(
|
|
findings,
|
|
a.checkResourceLimits(target, serviceName, node)...)
|
|
findings = append(
|
|
findings,
|
|
a.checkEnvironment(target, serviceName, node)...)
|
|
findings = append(findings, a.checkPorts(target, serviceName, node)...)
|
|
findings = append(findings, a.checkUser(target, serviceName, node)...)
|
|
findings = append(findings, a.checkReadOnly(target, serviceName, node)...)
|
|
|
|
return findings
|
|
}
|
|
|
|
func (a *ComposeAnalyzer) checkPrivileged(
|
|
target finding.Target,
|
|
serviceName string,
|
|
node *yaml.Node,
|
|
) finding.Collection {
|
|
var findings finding.Collection
|
|
|
|
privNode := findNode(node, "privileged")
|
|
if privNode != nil &&
|
|
(privNode.Value == "true" || privNode.Value == "yes") {
|
|
loc := &finding.Location{Path: a.path, Line: privNode.Line}
|
|
f := finding.New("CIS-5.4", "Service '"+serviceName+"' runs in privileged mode", finding.SeverityCritical, target).
|
|
WithDescription("Privileged containers have full access to host devices and bypass security features.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Remove 'privileged: true' and use specific capabilities instead.")
|
|
findings = append(findings, f)
|
|
}
|
|
|
|
return findings
|
|
}
|
|
|
|
func (a *ComposeAnalyzer) checkCapabilities(
|
|
target finding.Target,
|
|
serviceName string,
|
|
node *yaml.Node,
|
|
) finding.Collection {
|
|
var findings finding.Collection
|
|
|
|
capAddNode := findNode(node, "cap_add")
|
|
if capAddNode == nil {
|
|
return findings
|
|
}
|
|
|
|
for _, capNode := range capAddNode.Content {
|
|
capName := strings.ToUpper(capNode.Value)
|
|
capInfo, exists := rules.GetCapabilityInfo(capName)
|
|
if !exists {
|
|
continue
|
|
}
|
|
|
|
if capInfo.Severity >= finding.SeverityHigh {
|
|
loc := &finding.Location{Path: a.path, Line: capNode.Line}
|
|
title := "Service '" + serviceName + "' adds dangerous capability: " + capName
|
|
if capInfo.Severity == finding.SeverityCritical {
|
|
title = "Service '" + serviceName + "' adds critical capability: " + capName
|
|
}
|
|
f := finding.New("CIS-5.3", title, capInfo.Severity, target).
|
|
WithDescription(capInfo.Description).
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Remove unnecessary capabilities. Use --cap-drop=ALL and add only required capabilities.")
|
|
findings = append(findings, f)
|
|
}
|
|
}
|
|
|
|
return findings
|
|
}
|
|
|
|
func (a *ComposeAnalyzer) checkVolumes(
|
|
target finding.Target,
|
|
serviceName string,
|
|
node *yaml.Node,
|
|
) finding.Collection {
|
|
var findings finding.Collection
|
|
|
|
volumesNode := findNode(node, "volumes")
|
|
if volumesNode == nil {
|
|
return findings
|
|
}
|
|
|
|
for _, volNode := range volumesNode.Content {
|
|
var hostPath string
|
|
switch volNode.Kind {
|
|
case yaml.ScalarNode:
|
|
parts := strings.SplitN(volNode.Value, ":", 2)
|
|
hostPath = parts[0]
|
|
case yaml.MappingNode:
|
|
sourceNode := findNode(volNode, "source")
|
|
if sourceNode != nil {
|
|
hostPath = sourceNode.Value
|
|
}
|
|
}
|
|
|
|
if hostPath == "" {
|
|
continue
|
|
}
|
|
|
|
if rules.IsDockerSocket(hostPath) {
|
|
loc := &finding.Location{Path: a.path, Line: volNode.Line}
|
|
f := finding.New("CIS-5.31", "Service '"+serviceName+"' mounts Docker socket", finding.SeverityCritical, target).
|
|
WithDescription("Mounting Docker socket gives the container full control over the Docker daemon.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Do not mount /var/run/docker.sock inside containers.")
|
|
findings = append(findings, f)
|
|
continue
|
|
}
|
|
|
|
if rules.IsSensitivePath(hostPath) {
|
|
loc := &finding.Location{Path: a.path, Line: volNode.Line}
|
|
severity := rules.GetPathSeverity(hostPath)
|
|
pathInfo, _ := rules.GetPathInfo(hostPath)
|
|
description := "Mounting sensitive host paths can enable container escape."
|
|
if pathInfo.Description != "" {
|
|
description = pathInfo.Description
|
|
}
|
|
f := finding.New("CIS-5.5", "Service '"+serviceName+"' mounts sensitive path: "+hostPath, severity, target).
|
|
WithDescription(description).
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Do not mount sensitive host directories. Use Docker volumes instead.")
|
|
findings = append(findings, f)
|
|
}
|
|
}
|
|
|
|
return findings
|
|
}
|
|
|
|
func (a *ComposeAnalyzer) checkNetworkMode(
|
|
target finding.Target,
|
|
serviceName string,
|
|
node *yaml.Node,
|
|
) finding.Collection {
|
|
var findings finding.Collection
|
|
|
|
netNode := findNode(node, "network_mode")
|
|
if netNode != nil && netNode.Value == "host" {
|
|
loc := &finding.Location{Path: a.path, Line: netNode.Line}
|
|
f := finding.New("CIS-5.9", "Service '"+serviceName+"' uses host network mode", finding.SeverityHigh, target).
|
|
WithDescription("Host network mode allows the container to access all host network interfaces.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Use bridge networking instead of network_mode: host.")
|
|
findings = append(findings, f)
|
|
}
|
|
|
|
return findings
|
|
}
|
|
|
|
func (a *ComposeAnalyzer) checkPidMode(
|
|
target finding.Target,
|
|
serviceName string,
|
|
node *yaml.Node,
|
|
) finding.Collection {
|
|
var findings finding.Collection
|
|
|
|
pidNode := findNode(node, "pid")
|
|
if pidNode != nil && pidNode.Value == "host" {
|
|
loc := &finding.Location{Path: a.path, Line: pidNode.Line}
|
|
f := finding.New("CIS-5.15", "Service '"+serviceName+"' shares host PID namespace", finding.SeverityHigh, target).
|
|
WithDescription("Sharing PID namespace allows container to see and signal host processes.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Remove 'pid: host' from the service definition.")
|
|
findings = append(findings, f)
|
|
}
|
|
|
|
return findings
|
|
}
|
|
|
|
func (a *ComposeAnalyzer) checkIpcMode(
|
|
target finding.Target,
|
|
serviceName string,
|
|
node *yaml.Node,
|
|
) finding.Collection {
|
|
var findings finding.Collection
|
|
|
|
ipcNode := findNode(node, "ipc")
|
|
if ipcNode != nil && ipcNode.Value == "host" {
|
|
loc := &finding.Location{Path: a.path, Line: ipcNode.Line}
|
|
f := finding.New("CIS-5.16", "Service '"+serviceName+"' shares host IPC namespace", finding.SeverityHigh, target).
|
|
WithDescription("Sharing IPC namespace allows container to access host shared memory.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Remove 'ipc: host' from the service definition.")
|
|
findings = append(findings, f)
|
|
}
|
|
|
|
return findings
|
|
}
|
|
|
|
func (a *ComposeAnalyzer) checkSecurityOpt(
|
|
target finding.Target,
|
|
serviceName string,
|
|
node *yaml.Node,
|
|
) finding.Collection {
|
|
var findings finding.Collection
|
|
|
|
secOptNode := findNode(node, "security_opt")
|
|
if secOptNode == nil {
|
|
return findings
|
|
}
|
|
|
|
for _, optNode := range secOptNode.Content {
|
|
opt := strings.ToLower(optNode.Value)
|
|
|
|
if opt == "seccomp:unconfined" || opt == "seccomp=unconfined" {
|
|
loc := &finding.Location{Path: a.path, Line: optNode.Line}
|
|
f := finding.New("CIS-5.21", "Service '"+serviceName+"' disables seccomp profile", finding.SeverityHigh, target).
|
|
WithDescription("Disabling seccomp removes syscall restrictions from the container.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Remove 'seccomp:unconfined' and use default or custom seccomp profile.")
|
|
findings = append(findings, f)
|
|
}
|
|
|
|
if opt == "apparmor:unconfined" || opt == "apparmor=unconfined" {
|
|
loc := &finding.Location{Path: a.path, Line: optNode.Line}
|
|
f := finding.New("CIS-5.1", "Service '"+serviceName+"' disables AppArmor profile", finding.SeverityHigh, target).
|
|
WithDescription("Disabling AppArmor removes mandatory access control from the container.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Remove 'apparmor:unconfined' and use default or custom AppArmor profile.")
|
|
findings = append(findings, f)
|
|
}
|
|
}
|
|
|
|
return findings
|
|
}
|
|
|
|
func (a *ComposeAnalyzer) checkResourceLimits(
|
|
target finding.Target,
|
|
serviceName string,
|
|
node *yaml.Node,
|
|
) finding.Collection {
|
|
var findings finding.Collection
|
|
|
|
deployNode := findNode(node, "deploy")
|
|
var resourcesNode *yaml.Node
|
|
if deployNode != nil {
|
|
resourcesNode = findNode(deployNode, "resources")
|
|
}
|
|
|
|
memLimitNode := findNode(node, "mem_limit")
|
|
cpuLimitNode := findNode(node, "cpus")
|
|
pidsLimitNode := findNode(node, "pids_limit")
|
|
|
|
hasMemLimit := memLimitNode != nil
|
|
hasCpuLimit := cpuLimitNode != nil
|
|
hasPidsLimit := pidsLimitNode != nil
|
|
|
|
if resourcesNode != nil {
|
|
limitsNode := findNode(resourcesNode, "limits")
|
|
if limitsNode != nil {
|
|
if findNode(limitsNode, "memory") != nil {
|
|
hasMemLimit = true
|
|
}
|
|
if findNode(limitsNode, "cpus") != nil {
|
|
hasCpuLimit = true
|
|
}
|
|
if findNode(limitsNode, "pids") != nil {
|
|
hasPidsLimit = true
|
|
}
|
|
}
|
|
}
|
|
|
|
if !hasMemLimit {
|
|
loc := &finding.Location{Path: a.path, Line: node.Line}
|
|
f := finding.New("CIS-5.10", "Service '"+serviceName+"' has no memory limit", finding.SeverityMedium, target).
|
|
WithDescription("Without memory limits, a container can exhaust all available host memory.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Set mem_limit or deploy.resources.limits.memory for the service.")
|
|
findings = append(findings, f)
|
|
}
|
|
|
|
if !hasCpuLimit {
|
|
loc := &finding.Location{Path: a.path, Line: node.Line}
|
|
f := finding.New("CIS-5.11", "Service '"+serviceName+"' has no CPU limit", finding.SeverityMedium, target).
|
|
WithDescription("Without CPU limits, a container can consume all available CPU resources.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Set cpus or deploy.resources.limits.cpus for the service.")
|
|
findings = append(findings, f)
|
|
}
|
|
|
|
if !hasPidsLimit {
|
|
loc := &finding.Location{Path: a.path, Line: node.Line}
|
|
f := finding.New("CIS-5.28", "Service '"+serviceName+"' has no PIDs limit", finding.SeverityMedium, target).
|
|
WithDescription("Without PIDs limits, a container can fork-bomb and exhaust process table.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Set pids_limit or deploy.resources.limits.pids for the service.")
|
|
findings = append(findings, f)
|
|
}
|
|
|
|
return findings
|
|
}
|
|
|
|
func (a *ComposeAnalyzer) checkEnvironment(
|
|
target finding.Target,
|
|
serviceName string,
|
|
node *yaml.Node,
|
|
) finding.Collection {
|
|
var findings finding.Collection
|
|
|
|
envNode := findNode(node, "environment")
|
|
if envNode == nil {
|
|
return findings
|
|
}
|
|
|
|
if envNode.Kind == yaml.MappingNode {
|
|
for i := 0; i < len(envNode.Content); i += 2 {
|
|
if i+1 >= len(envNode.Content) {
|
|
break
|
|
}
|
|
keyNode := envNode.Content[i]
|
|
valueNode := envNode.Content[i+1]
|
|
|
|
if rules.IsSensitiveEnvName(keyNode.Value) &&
|
|
valueNode.Value != "" {
|
|
if !isVariableReference(valueNode.Value) {
|
|
loc := &finding.Location{Path: a.path, Line: keyNode.Line}
|
|
f := finding.New("CIS-4.10", "Service '"+serviceName+"' has sensitive variable '"+keyNode.Value+"' with hardcoded value", finding.SeverityHigh, target).
|
|
WithDescription("Hardcoding secrets in compose files exposes them in version control.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Use environment variable substitution: ${" + keyNode.Value + "} or Docker secrets.")
|
|
findings = append(findings, f)
|
|
}
|
|
}
|
|
|
|
secrets := rules.DetectSecrets(valueNode.Value)
|
|
for _, secret := range secrets {
|
|
loc := &finding.Location{Path: a.path, Line: valueNode.Line}
|
|
f := finding.New("CIS-4.10", "Service '"+serviceName+"' may contain "+string(secret.Type)+" in environment", finding.SeverityHigh, target).
|
|
WithDescription(secret.Description + " detected in environment variable.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Remove secrets from compose file. Use Docker secrets or external secret management.")
|
|
findings = append(findings, f)
|
|
}
|
|
}
|
|
} else if envNode.Kind == yaml.SequenceNode {
|
|
for _, itemNode := range envNode.Content {
|
|
parts := strings.SplitN(itemNode.Value, "=", 2)
|
|
if len(parts) < 2 {
|
|
continue
|
|
}
|
|
varName := parts[0]
|
|
varValue := parts[1]
|
|
|
|
if rules.IsSensitiveEnvName(varName) && varValue != "" {
|
|
if !isVariableReference(varValue) {
|
|
loc := &finding.Location{
|
|
Path: a.path,
|
|
Line: itemNode.Line,
|
|
}
|
|
f := finding.New("CIS-4.10", "Service '"+serviceName+"' has sensitive variable '"+varName+"' with hardcoded value", finding.SeverityHigh, target).
|
|
WithDescription("Hardcoding secrets in compose files exposes them in version control.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Use environment variable substitution: ${" + varName + "} or Docker secrets.")
|
|
findings = append(findings, f)
|
|
}
|
|
}
|
|
|
|
secrets := rules.DetectSecrets(varValue)
|
|
for _, secret := range secrets {
|
|
loc := &finding.Location{Path: a.path, Line: itemNode.Line}
|
|
f := finding.New("CIS-4.10", "Service '"+serviceName+"' may contain "+string(secret.Type)+" in environment", finding.SeverityHigh, target).
|
|
WithDescription(secret.Description + " detected in environment variable.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Remove secrets from compose file. Use Docker secrets or external secret management.")
|
|
findings = append(findings, f)
|
|
}
|
|
}
|
|
}
|
|
|
|
return findings
|
|
}
|
|
|
|
func (a *ComposeAnalyzer) checkPorts(
|
|
target finding.Target,
|
|
serviceName string,
|
|
node *yaml.Node,
|
|
) finding.Collection {
|
|
var findings finding.Collection
|
|
|
|
portsNode := findNode(node, "ports")
|
|
if portsNode == nil {
|
|
return findings
|
|
}
|
|
|
|
for _, portNode := range portsNode.Content {
|
|
var portSpec string
|
|
switch portNode.Kind {
|
|
case yaml.ScalarNode:
|
|
portSpec = portNode.Value
|
|
case yaml.MappingNode:
|
|
publishedNode := findNode(portNode, "published")
|
|
hostIPNode := findNode(portNode, "host_ip")
|
|
if publishedNode != nil {
|
|
portSpec = publishedNode.Value
|
|
}
|
|
if hostIPNode != nil && hostIPNode.Value == "0.0.0.0" {
|
|
loc := &finding.Location{Path: a.path, Line: hostIPNode.Line}
|
|
f := finding.New("DS-COMPOSE-BIND", "Service '"+serviceName+"' explicitly binds to 0.0.0.0", finding.SeverityInfo, target).
|
|
WithDescription("Binding to 0.0.0.0 exposes the port on all network interfaces.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Consider binding to 127.0.0.1 for local-only access.")
|
|
findings = append(findings, f)
|
|
}
|
|
}
|
|
|
|
if portSpec == "" {
|
|
continue
|
|
}
|
|
|
|
parts := strings.Split(portSpec, ":")
|
|
var hostPort string
|
|
if len(parts) >= 2 {
|
|
hostPort = parts[0]
|
|
if strings.Contains(hostPort, ".") {
|
|
hostPort = parts[1]
|
|
}
|
|
}
|
|
|
|
if hostPort != "" {
|
|
portNum, err := strconv.Atoi(hostPort)
|
|
if err == nil && portNum > 0 && portNum < 1024 {
|
|
loc := &finding.Location{Path: a.path, Line: portNode.Line}
|
|
f := finding.New("DS-COMPOSE-PRIVPORT", "Service '"+serviceName+"' exposes privileged port "+hostPort, finding.SeverityInfo, target).
|
|
WithDescription("Privileged ports (below 1024) typically require root privileges on the host.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Consider using non-privileged ports (>1024) with port mapping.")
|
|
findings = append(findings, f)
|
|
}
|
|
}
|
|
}
|
|
|
|
return findings
|
|
}
|
|
|
|
func (a *ComposeAnalyzer) checkUser(
|
|
target finding.Target,
|
|
serviceName string,
|
|
node *yaml.Node,
|
|
) finding.Collection {
|
|
var findings finding.Collection
|
|
|
|
userNode := findNode(node, "user")
|
|
if userNode == nil {
|
|
loc := &finding.Location{Path: a.path, Line: node.Line}
|
|
f := finding.New("CIS-4.1", "Service '"+serviceName+"' does not specify user", finding.SeverityMedium, target).
|
|
WithDescription("Without a user specification, the container may run as root.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Add 'user: \"1000:1000\"' or use the USER directive in the Dockerfile.")
|
|
findings = append(findings, f)
|
|
} else if userNode.Value == "root" || userNode.Value == "0" || userNode.Value == "0:0" {
|
|
loc := &finding.Location{Path: a.path, Line: userNode.Line}
|
|
f := finding.New("DS-COMPOSE-ROOT", "Service '"+serviceName+"' explicitly runs as root", finding.SeverityMedium, target).
|
|
WithDescription("Running containers as root increases the risk of container escape.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Create and use a non-root user in the Dockerfile or compose file.")
|
|
findings = append(findings, f)
|
|
}
|
|
|
|
return findings
|
|
}
|
|
|
|
func (a *ComposeAnalyzer) checkReadOnly(
|
|
target finding.Target,
|
|
serviceName string,
|
|
node *yaml.Node,
|
|
) finding.Collection {
|
|
var findings finding.Collection
|
|
|
|
readOnlyNode := findNode(node, "read_only")
|
|
if readOnlyNode == nil || readOnlyNode.Value != "true" {
|
|
loc := &finding.Location{Path: a.path, Line: node.Line}
|
|
f := finding.New("CIS-5.12", "Service '"+serviceName+"' does not use read-only root filesystem", finding.SeverityMedium, target).
|
|
WithDescription("A writable root filesystem allows attackers to modify container binaries.").
|
|
WithCategory(string(CategoryCompose)).
|
|
WithLocation(loc).
|
|
WithRemediation("Add 'read_only: true' and use tmpfs volumes for writable directories.")
|
|
findings = append(findings, f)
|
|
}
|
|
|
|
return findings
|
|
}
|
|
|
|
func findNode(node *yaml.Node, key string) *yaml.Node {
|
|
if node == nil {
|
|
return nil
|
|
}
|
|
|
|
if node.Kind == yaml.DocumentNode && len(node.Content) > 0 {
|
|
return findNode(node.Content[0], key)
|
|
}
|
|
|
|
if node.Kind != yaml.MappingNode {
|
|
return nil
|
|
}
|
|
|
|
for i := 0; i < len(node.Content); i += 2 {
|
|
if i+1 >= len(node.Content) {
|
|
break
|
|
}
|
|
if node.Content[i].Value == key {
|
|
return node.Content[i+1]
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func isVariableReference(value string) bool {
|
|
return strings.HasPrefix(value, "${") || strings.HasPrefix(value, "$")
|
|
}
|