cnspec
cnspec copied to clipboard
🐛 Query-level filters are not respected
Describe the bug Consider the following policy:
policies:
- name: testpolicy1
uid: testpolicy1
groups:
- filters: return false
checks:
- uid: query-1
queries:
- uid: query-1
filters: return true
mql: return 2 > 1
This policy has a group filter of false, whereas the query below has a filter of true. By logic, the query should not get executed and there should be no score for the policy as the group filter should skip over that query.
Running this however yields a score for the policy (note the query has no score).
Expected behavior I would expect that this policy is not ran at all, there are no matching filters here. To be more precise, I wouldn't expect a score in the resolved policy for that policy.