Skyscanner / cfripper

Library and CLI tool for analysing CloudFormation templates and check them for security compliance.

Home Page:https://cfripper.readthedocs.io/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

AttributeError: 'NoneType' object has no attribute 'split' when using CommaDelimitedList

crystoll opened this issue · comments

Tested with versions: 0.18, 0.19

When I create very simple cf yaml template like this:

AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  SubnetIds:
    Type: CommaDelimitedList
    Description: Select at least two subnets in your selected VPC.

And run it like this:

cfripper test.yaml --resolve

It fails with:

Analysing test.yaml...
Unhandled exception raised, please create an issue wit the error message at https://github.com/Skyscanner/cfripper/issues
Traceback (most recent call last):
  File "/home/arto/.local/lib/python3.8/site-packages/cfripper/cli.py", line 150, in cli
    process_template(template=template, resolve_parameters=resolve_parameters, **kwargs)
  File "/home/arto/.local/lib/python3.8/site-packages/cfripper/cli.py", line 91, in process_template
    cfmodel = cfmodel.resolve(resolve_parameters)
  File "/home/arto/.local/lib/python3.8/site-packages/pycfmodel/model/cf_model.py", line 72, in resolve
    ref_value = parameter.get_ref_value(passed_value)
  File "/home/arto/.local/lib/python3.8/site-packages/pycfmodel/model/parameter.py", line 52, in get_ref_value
    return value.split(",")
AttributeError: 'NoneType' object has no attribute 'split'

Some other observations:

  • It passes of course without --resolve flag
  • With --resolve-parameters it probably succeeds. However, I did not try creating parameter file because we are trying to use this as quality gate step for templates without specifying custom parameter values for them. Not sure if this is supported, or if in this case parameters must be used.
  • With default parameter values it of course works, not willing to define placeholders just for sake of validation build step though

So it seems to me that would be great to have CommaDelimitedList type recognize when it does not have default or assigned value, and either use a build-in value, or at least not try to split it. I cannot say if this is a bug in --resolve functionality, or working as intended, but wanted to bring out this observation. We have been working around this by not using --resolve flag, then we of course don't get any exceptions from this.

I'm not completely sure what should be the expected behaviour here:

  • We have a required parameter, without default value
  • Resolve is being called
  • Trying to resolve a required parameter, should probably raise an error

The way I see it there are 3 options:

  • You set a dummy default value to your CF file
  • You pass a value for this parameter as a cli option
  • We add a default value for unasigned coma delimited parameters

I'll discuss this with the team, but meanwhile I'd recommend you use one of the 2 first options as it's quite simple to workaround.

Hi, thank you, I appreciate the reply. Two two workaround would work to work around the problem, but...

Workaround one would have us set dummy default values in our template just for the sake of running cfripper, instead of keeping them clean, and to the point. So we would like to avoid that.

Workaround two would be elegant way to handle things, and possibly is the way we will have to go at some point. But it takes away possibility to use cfripper as general tool used by all teams against any templates. We have a nice bash script that goes to a folder, enumerates all templates, and feeds them all to cfripper. Needing to parameterized the runs would force us to drop that generic functionality, or mandate to always create similarly named parameter file for each template we do. That might still work.

There is also workaround three: Not to use the resolve if not willing to use the param file. It's a possibility for us, too.

Still, great thing if you can discuss that default value for unassigned commadelimited, since it seems to be the only thing causing exception if we don't define default values - everything else works as it is. Whatever you decide on this, thanks for creating this great tool!