ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 04:51:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(attack-paths): remove duplicate path_target causing disconnected nodes

Browse Source 
Removed the extra path_target re-match that was causing role nodes to appear
disconnected in the visualization. The target_role is now only connected via
virtual relationships (PASSES_ROLE → target_role → GRANTS_ACCESS), which
provides a cleaner and more accurate attack path visualization.
This commit is contained in:
Andoni A.
2026-01-14 09:11:27 +01:00
parent 1d8d4f9325
commit e426c29207
1 changed files with 15 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/src/backend/api/attack_paths/query_definitions.py
+15 -20
View File
@@ -670,12 +670,11 @@ _QUERY_DEFINITIONS: dict[str, list[AttackPathsQueryDefinition]] = {
}, escalation_outcome)
YIELD rel AS grants_rel
// Re-match paths for visualization
// Re-match path for visualization (only principal path, target_role is connected via virtual rels)
MATCH path_principal = (aws)--(principal)
MATCH path_target = (aws)--(target_role)
RETURN path_principal, path_target,
lambda_node, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
RETURN path_principal,
lambda_node, target_role, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
""",
parameters=[],
),
@@ -816,12 +815,11 @@ _QUERY_DEFINITIONS: dict[str, list[AttackPathsQueryDefinition]] = {
}, escalation_outcome)
YIELD rel AS grants_rel
// Re-match paths for visualization
// Re-match path for visualization (only principal path, target_role is connected via virtual rels)
MATCH path_principal = (aws)--(principal)
MATCH path_target = (aws)--(target_role)
RETURN path_principal, path_target,
ecs_task, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
RETURN path_principal,
ecs_task, target_role, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
""",
parameters=[],
),
@@ -967,12 +965,11 @@ _QUERY_DEFINITIONS: dict[str, list[AttackPathsQueryDefinition]] = {
}, escalation_outcome)
YIELD rel AS grants_rel
// Re-match paths for visualization
// Re-match path for visualization (only principal path, target_role is connected via virtual rels)
MATCH path_principal = (aws)--(principal)
MATCH path_target = (aws)--(target_role)
RETURN path_principal, path_target,
glue_endpoint, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
RETURN path_principal,
glue_endpoint, target_role, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
""",
parameters=[],
),
@@ -1061,12 +1058,11 @@ _QUERY_DEFINITIONS: dict[str, list[AttackPathsQueryDefinition]] = {
}, escalation_outcome)
YIELD rel AS grants_rel
// Re-match paths for visualization
// Re-match path for visualization (only principal path, target_role is connected via virtual rels)
MATCH path_principal = (aws)--(principal)
MATCH path_target = (aws)--(target_role)
RETURN path_principal, path_target,
bedrock_agent, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
RETURN path_principal,
bedrock_agent, target_role, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
""",
parameters=[],
),
@@ -1147,12 +1143,11 @@ _QUERY_DEFINITIONS: dict[str, list[AttackPathsQueryDefinition]] = {
}, escalation_outcome)
YIELD rel AS grants_rel
// Re-match paths for visualization
// Re-match path for visualization (only principal path, target_role is connected via virtual rels)
MATCH path_principal = (aws)--(principal)
MATCH path_target = (aws)--(target_role)
RETURN path_principal, path_target,
cfn_stack, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
RETURN path_principal,
cfn_stack, target_role, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
""",
parameters=[],
),