From 73b3484ce86296acbc99581daee1cd92603cae8c Mon Sep 17 00:00:00 2001
From: Pepe Fagoaga <pepe@prowler.com>
Date: Mon, 20 May 2024 12:30:50 +0200
Subject: [PATCH] fix(mutelist): Handle exceptions before match (#4024)

---
 prowler/lib/mutelist/mutelist.py    | 26 ++++++++++++---------
 tests/lib/mutelist/mutelist_test.py | 35 +++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+), 11 deletions(-)

diff --git a/prowler/lib/mutelist/mutelist.py b/prowler/lib/mutelist/mutelist.py
index 432f5ef121..1528608c36 100644
--- a/prowler/lib/mutelist/mutelist.py
+++ b/prowler/lib/mutelist/mutelist.py
@@ -211,14 +211,22 @@ def is_muted_in_check(
             # map lambda to awslambda
             muted_check = re.sub("^lambda", "awslambda", muted_check)
 
+            check_match = (
+                "*" == muted_check
+                or check == muted_check
+                or re.search(muted_check, check)
+            )
             # Check if the finding is excepted
             exceptions = muted_check_info.get("Exceptions")
-            if is_excepted(
-                exceptions,
-                audited_account,
-                finding_region,
-                finding_resource,
-                finding_tags,
+            if (
+                is_excepted(
+                    exceptions,
+                    audited_account,
+                    finding_region,
+                    finding_resource,
+                    finding_tags,
+                )
+                and check_match
             ):
                 # Break loop and return default value since is excepted
                 break
@@ -230,11 +238,7 @@ def is_muted_in_check(
             if not muted_tags:
                 muted_tags = "*"
             # If there is a *, it affects to all checks
-            if (
-                "*" == muted_check
-                or check == muted_check
-                or re.search(muted_check, check)
-            ):
+            if check_match:
                 muted_in_check = True
                 muted_in_region = is_muted_in_region(muted_regions, finding_region)
                 muted_in_resource = is_muted_in_resource(
diff --git a/tests/lib/mutelist/mutelist_test.py b/tests/lib/mutelist/mutelist_test.py
index f89f47704f..f9c71d02c3 100644
--- a/tests/lib/mutelist/mutelist_test.py
+++ b/tests/lib/mutelist/mutelist_test.py
@@ -452,6 +452,41 @@ class TestMutelist:
             )
         )
 
+    def test_is_muted_exceptions_before_match(self):
+        # Mutelist example
+        mutelist = {
+            "Accounts": {
+                "*": {
+                    "Checks": {
+                        "accessanalyzer_enabled": {
+                            "Exceptions": {
+                                "Accounts": [],
+                                "Regions": [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1],
+                                "Resources": [],
+                                "Tags": [],
+                            },
+                            "Regions": ["*"],
+                            "Resources": ["*"],
+                            "Tags": ["*"],
+                        },
+                        "sns_*": {
+                            "Regions": ["*"],
+                            "Resources": ["aws-controltower-*"],
+                        },
+                    }
+                }
+            }
+        }
+
+        assert is_muted(
+            mutelist,
+            AWS_ACCOUNT_NUMBER,
+            "sns_topics_not_publicly_accessible",
+            AWS_REGION_EU_WEST_1,
+            "aws-controltower-AggregateSecurityNotifications",
+            "",
+        )
+
     def test_is_muted_all_and_single_account(self):
         # Mutelist example
         mutelist = {