Parsing of heredocs does not allow arbitrary strings

[edmundcraske-bjss]

I originally raised this at amplify-education#141 but I guess as you use this fork for checkov then maybe it needs fixing here first?

I am hitting an issue with https://github.com/bridgecrewio/checkov/ throwing a parsing error where a .tf file containing an aws_codebuild_project resource has a buildspec attribute defined using a heredoc that contains a shell script, and some of the lines in the shell script are long, and split using the \ as continuation character. In some cases there is a " opened and not closed until another line, and I am getting an unhandled exception (seen when setting LOG_LEVEL=DEBUG):

  File "/opt/homebrew/Cellar/checkov/2.3.330/libexec/lib/python3.11/site-packages/checkov/terraform/modules/module_utils.py", line 74, in load_or_die_quietly
    raw_data = hcl2.load(f)
               ^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/checkov/2.3.330/libexec/lib/python3.11/site-packages/hcl2/api.py", line 15, in load
    return loads(file.read())
           ^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/checkov/2.3.330/libexec/lib/python3.11/site-packages/hcl2/api.py", line 82, in loads
    raise ValueError(f"Line has unclosed quote marks: {line}")

But I'm not sure that the parser should even be parsing the heredoc, let alone having an issue with quotes in a bash script contained within a perfectly valid string where the Terraform code definitely works... Any suggestions?

[gruebel]

hey @edmundcraske-bjss thanks for reaching out.

We do a pre-testing of quotes, because we have issues with TF templates, which are invalid and result in an infinte loop processing. Can you add a simple example, which results in the mentioned error?

[gruebel]

feel free to reach out with an example to better debug it 🙂