Skip to content

Fix stale Checkov runner state between scans - #62

Open
rnehoroshev wants to merge 1 commit into
bridgecrewio:mainfrom
rnehoroshev:fix/checkov-runner-state-leak
Open

rnehoroshev wants to merge 1 commit into
bridgecrewio:mainfrom
rnehoroshev:fix/checkov-runner-state-leak

Conversation

@rnehoroshev

Copy link
Copy Markdown

Summary

  • create fresh Checkov runner instances for each CheckovWhorf instance
  • add regression coverage for consecutive Kubernetes scans in the same process
  • align the upload_results override with Checkov's current signature

Problem

Checkov.__init__ shallow-copies a module-level list of instantiated runners. Some runners retain mutable scan state, so a later admission request can process manifest data left behind by an earlier request.

Solution

Replace the shallow-copied runners with newly constructed instances whenever Whorf creates a Checkov scanner.

Checkov shallow-copies its module-level runner instances, allowing mutable
scan state to leak between admission requests. Instantiate fresh runners for
each CheckovWhorf instance and add regression coverage for consecutive scans.
@rnehoroshev

Copy link
Copy Markdown
Author

@Saarett Could you review please? This is a critical fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant