Extractor for Terraform and Terraform lock files

docs/supported_inventory_types.md

@@ -166,11 +166,13 @@ See the docs on [how to add a new Extractor](/docs/new_extractor.md).
 
 ### Misc
 
-| Type              | Extractor Plugin    |
-|-------------------|---------------------|
-| Wordpress plugins | `wordpress/plugins` |
-| VSCode extensions | `vscode/extensions` |
-| Chrome extensions | `chrome/extensions` |
+| Type                | Extractor Plugin     |
+|---------------------|----------------------|
+| Wordpress plugins   | `wordpress/plugins`  |
+| Terraform lock file | `misc/terraformlock` |
+| Terraform providers | `misc/terraform`     |
+| VSCode extensions   | `vscode/extensions`  |
+| Chrome extensions   | `chrome/extensions`  |
 
 ## Detectors
 

extractor/filesystem/misc/terraform/terraform.go

@@ -0,0 +1,173 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package terraform extracts modules and providers from Terraform configuration files.
+package terraform
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"path/filepath"
+	"strings"
+
+	"github.com/google/osv-scalibr/extractor"
+	"github.com/google/osv-scalibr/extractor/filesystem"
+	"github.com/google/osv-scalibr/inventory"
+	"github.com/google/osv-scalibr/plugin"
+	"github.com/google/osv-scalibr/purl"
+	"github.com/hashicorp/hcl/v2/hclparse"
+	"github.com/hashicorp/hcl/v2/hclsyntax"
+	"github.com/zclconf/go-cty/cty"
+)
+
+const (
+	// Name is the unique name of this extractor.
+	Name = "misc/terraform"
+)
+
+// Extractor extracts Terraform modules and providers.
+type Extractor struct{}
+
+// New returns a new instance of the extractor.
+func New() filesystem.Extractor { return &Extractor{} }
+
+// Name of the extractor.
+func (e Extractor) Name() string { return Name }
+
+// Version of the extractor.
+func (e Extractor) Version() int { return 0 }
+
+// Requirements of the extractor.
+func (e Extractor) Requirements() *plugin.Capabilities {
+	return &plugin.Capabilities{}
+}
+
+// FileRequired returns true if the file extension is '.tf'.
+func (e Extractor) FileRequired(api filesystem.FileAPI) bool {
+	return filepath.Ext(api.Path()) == ".tf"
+}
+
+// Extract extracts packages from Terraform configuration files.
+//
+// It extracts:
+// - Modules with versions from module blocks
+// - Providers with versions from terraform.required_providers blocks
+func (e Extractor) Extract(ctx context.Context, input *filesystem.ScanInput) (inventory.Inventory, error) {
+	content, err := io.ReadAll(input.Reader)
+	if err != nil {
+		return inventory.Inventory{}, fmt.Errorf("failed to read file: %w", err)
+	}
+
+	parser := hclparse.NewParser()
+	file, diags := parser.ParseHCL(content, input.Path)
+	if diags.HasErrors() {
+		return inventory.Inventory{}, fmt.Errorf("failed to parse HCL: %w", diags)
+	}
+
+	var pkgs []*extractor.Package
+
+	// Extract packages from the parsed file
+	body, ok := file.Body.(*hclsyntax.Body)
+	if !ok {
+		return inventory.Inventory{}, fmt.Errorf("unexpected body type")
+	}
+
+	for _, block := range body.Blocks {
+		if err := ctx.Err(); err != nil {
+			return inventory.Inventory{}, fmt.Errorf("%s halted due to context error: %w", e.Name(), err)
+		}
+
+		switch block.Type {
+		case "module":
+			if pkg := extractModule(block, input.Path); pkg != nil {
+				pkgs = append(pkgs, pkg)
+			}
+		case "terraform":
+			providerPkgs := extractProviders(block, input.Path)
+			pkgs = append(pkgs, providerPkgs...)
+		}
+	}
+
+	return inventory.Inventory{Packages: pkgs}, nil
+}
+
+func extractModule(block *hclsyntax.Block, location string) *extractor.Package {
+	var source, version string
+
+	for _, attr := range block.Body.Attributes {
+		switch attr.Name {
+		case "source":
+			if val, diags := attr.Expr.Value(nil); !diags.HasErrors() && val.Type() == cty.String {
+				source = val.AsString()
+			}
+		case "version":
+			if val, diags := attr.Expr.Value(nil); !diags.HasErrors() && val.Type() == cty.String {
+				version = val.AsString()
+			}
+		}
+	}
+
+	// Only extract modules with versions and non-local sources
+	if version == "" || source == "" || strings.HasPrefix(source, ".") || strings.HasPrefix(source, "/") {
+		return nil
+	}
+
+	return &extractor.Package{
+		Name:      source,
+		Version:   version,
+		PURLType:  purl.TypeTerraform,
+		Locations: []string{location},
+	}
+}
+
+func extractProviders(terraformBlock *hclsyntax.Block, location string) []*extractor.Package {
+	var pkgs []*extractor.Package
+
+	for _, block := range terraformBlock.Body.Blocks {
+		if block.Type != "required_providers" {
+			continue
+		}
+
+		for _, attr := range block.Body.Attributes {
+			// The attribute value should be an object with source and optionally version
+			val, diags := attr.Expr.Value(nil)
+			if diags.HasErrors() || !val.Type().IsObjectType() {
+				continue
+			}
+
+			var source, version string
+			valMap := val.AsValueMap()
+
+			if sourceVal, ok := valMap["source"]; ok && sourceVal.Type() == cty.String {
+				source = sourceVal.AsString()
+			}
+			if versionVal, ok := valMap["version"]; ok && versionVal.Type() == cty.String {
+				version = versionVal.AsString()
+			}
+
+			// Only extract providers with both source and version
+			if source != "" && version != "" {
+				pkgs = append(pkgs, &extractor.Package{
+					Name:      source,
+					Version:   version,
+					PURLType:  purl.TypeTerraform,
+					Locations: []string{location},
+				})
+			}
+		}
+	}
+
+	return pkgs
+}

extractor/filesystem/misc/terraform/terraform_test.go

@@ -0,0 +1,181 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package terraform_test
+
+import (
+	"io/fs"
+	"path/filepath"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/google/osv-scalibr/extractor"
+	"github.com/google/osv-scalibr/extractor/filesystem"
+	"github.com/google/osv-scalibr/extractor/filesystem/misc/terraform"
+	"github.com/google/osv-scalibr/extractor/filesystem/simplefileapi"
+	"github.com/google/osv-scalibr/inventory"
+	"github.com/google/osv-scalibr/purl"
+	"github.com/google/osv-scalibr/testing/extracttest"
+	"github.com/google/osv-scalibr/testing/fakefs"
+)
+
+func TestFileRequired(t *testing.T) {
+	tests := []struct {
+		name         string
+		path         string
+		wantRequired bool
+	}{
+		{
+			name:         "terraform file",
+			path:         "main.tf",
+			wantRequired: true,
+		},
+		{
+			name:         "terraform file with path",
+			path:         "/path/to/main.tf",
+			wantRequired: true,
+		},
+		{
+			name:         "not terraform file",
+			path:         "/tmp/var/scalibr",
+			wantRequired: false,
+		},
+		{
+			name:         "txt file",
+			path:         "readme.txt",
+			wantRequired: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var e filesystem.Extractor = terraform.Extractor{}
+			if got := e.FileRequired(simplefileapi.New(tt.path, fakefs.FakeFileInfo{
+				FileName: filepath.Base(tt.path),
+				FileMode: fs.ModePerm,
+				FileSize: 30 * 1024,
+			})); got != tt.wantRequired {
+				t.Fatalf("FileRequired(%s): got %v, want %v", tt.path, got, tt.wantRequired)
+			}
+		})
+	}
+}
+
+func TestExtract(t *testing.T) {
+	tests := []struct {
+		name            string
+		wantPackages    []*extractor.Package
+		inputConfigFile extracttest.ScanInputMockConfig
+	}{
+		{
+			name: "module with version",
+			inputConfigFile: extracttest.ScanInputMockConfig{
+				Path: "testdata/terraform-1.tf",
+			},
+			wantPackages: []*extractor.Package{
+				{
+					Name:      "terraform-aws-modules/vpc/aws",
+					Version:   "6.0.1",
+					PURLType:  purl.TypeTerraform,
+					Locations: []string{"testdata/terraform-1.tf"},
+				},
+			},
+		},
+		{
+			name: "local module without version",
+			inputConfigFile: extracttest.ScanInputMockConfig{
+				Path: "testdata/terraform-2.tf",
+			},
+			wantPackages: nil,
+		},
+		{
+			name: "provider with version",
+			inputConfigFile: extracttest.ScanInputMockConfig{
+				Path: "testdata/terraform-3.tf",
+			},
+			wantPackages: []*extractor.Package{
+				{
+					Name:      "hashicorp/aws",
+					Version:   "~> 5.92",
+					PURLType:  purl.TypeTerraform,
+					Locations: []string{"testdata/terraform-3.tf"},
+				},
+			},
+		},
+		{
+			name: "provider without version",
+			inputConfigFile: extracttest.ScanInputMockConfig{
+				Path: "testdata/terraform-4.tf",
+			},
+			wantPackages: nil,
+		},
+		{
+			name: "empty terraform file",
+			inputConfigFile: extracttest.ScanInputMockConfig{
+				Path: "testdata/empty.tf",
+			},
+			wantPackages: nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			extr := terraform.Extractor{}
+
+			scanInput := extracttest.GenerateScanInputMock(t, tt.inputConfigFile)
+			defer extracttest.CloseTestScanInput(t, scanInput)
+
+			got, err := extr.Extract(t.Context(), &scanInput)
+			if err != nil {
+				t.Fatalf("Extract() error = %v", err)
+			}
+
+			wantInv := inventory.Inventory{Packages: tt.wantPackages}
+			if diff := cmp.Diff(wantInv, got, cmpopts.SortSlices(extracttest.PackageCmpLess)); diff != "" {
+				t.Errorf("%s.Extract(%q) diff (-want +got):\n%s", extr.Name(), tt.inputConfigFile.Path, diff)
+			}
+		})
+	}
+}
+
+func TestExtractErrors(t *testing.T) {
+	tests := []struct {
+		name            string
+		inputConfigFile extracttest.ScanInputMockConfig
+		wantErr         bool
+	}{
+		{
+			name: "invalid terraform file",
+			inputConfigFile: extracttest.ScanInputMockConfig{
+				Path: "testdata/invalid.tf",
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			extr := terraform.Extractor{}
+
+			scanInput := extracttest.GenerateScanInputMock(t, tt.inputConfigFile)
+			defer extracttest.CloseTestScanInput(t, scanInput)
+
+			_, err := extr.Extract(t.Context(), &scanInput)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("Extract() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}

extractor/filesystem/misc/terraform/testdata/invalid.tf

@@ -0,0 +1,2 @@
+this is not valid terraform syntax {
+  invalid block

extractor/filesystem/misc/terraform/testdata/terraform-1.tf

@@ -0,0 +1,4 @@
+module "vcp" {
+  source  = "terraform-aws-modules/vpc/aws"
+  version = "6.0.1"
+}