Enable https check in runtime

lib/sobelow/config/https.ex

@@ -16,28 +16,40 @@ defmodule Sobelow.Config.HTTPS do
 
   @uid 9
   @finding_type "Config.HTTPS: HTTPS Not Enabled"
+  @files_to_check ["prod.exs", "runtime.exs"]
 
   use Sobelow.Finding
 
-  def run(dir_path, configs) do
-    path = dir_path <> "prod.exs"
+  def run(dir_path, configs, files_to_check \\ @files_to_check) do
+    configs_in_files = configs_in_files(dir_path, configs, files_to_check)
 
-    if File.exists?(path) && Enum.member?(configs, "prod.exs") do
-      https = Config.get_configs_by_file(:https, path)
-
-      (Config.get_configs_by_file(:force_ssl, path) ++ https)
-      |> handle_https(path)
+    if !Enum.empty?(configs_in_files) && Enum.all?(configs_in_files, &https_config_missing?/1) do
+      Enum.each(configs_in_files, fn {path, _} ->
+        add_finding(path)
+      end)
     end
   end
 
-  defp handle_https(opts, path) do
-    if Enum.empty?(opts) do
-      add_finding(path)
-    end
+  defp configs_in_files(dir_path, configs, files) do
+    files
+    |> Enum.map(fn file_path ->
+      path = dir_path <> file_path
+      exists = File.exists?(path) && Enum.member?(configs, file_path)
+      {path, exists}
+    end)
+    |> Enum.filter(fn {_path, exists} -> exists end)
+    |> Enum.map(fn {path, _exists} ->
+      https = Config.get_configs_by_file(:https, path)
+      {path, Config.get_configs_by_file(:force_ssl, path) ++ https}
+    end)
+  end
+
+  defp https_config_missing?({_path, opts}) do
+    Enum.empty?(opts)
   end
 
   defp add_finding(file) do
-    reason = "HTTPS configuration details could not be found in `prod.exs`."
+    reason = "HTTPS configuration details could not be found in `prod.exs` nor `runtime.exs`."
 
     finding =
       %Finding{

test/config/https_test.exs

@@ -0,0 +1,36 @@
+defmodule SobelowTest.Config.HttpsTest do
+  use ExUnit.Case
+  alias Sobelow.Config.HTTPS
+
+  setup do
+    Application.put_env(:sobelow, :format, "json")
+    Sobelow.Fingerprint.start_link()
+    Sobelow.FindingLog.start_link()
+
+    :ok
+  end
+
+  test "does not log when force_ssl is present in prod.exs" do
+    refute HTTPS.run("./test/fixtures/https/", ["prod.exs"])
+  end
+
+  test "does not log when force_ssl is present in runtime.exs" do
+    refute HTTPS.run("./test/fixtures/https/", ["runtime.exs"])
+  end
+
+  test "does not log when files don't exist" do
+    refute HTTPS.run("./test/fixtures/https/", ["prod.exs"], ["prod_does_not_exist.exs"])
+  end
+
+  test "does not log when one of the files has the https enabled" do
+    refute HTTPS.run("./test/fixtures/https/", ["prod.exs"], [
+             "prod_without_https.exs",
+             "prod.exs"
+           ])
+  end
+
+  test "logs when config files exist but https in not found any of them" do
+    HTTPS.run("./test/fixtures/https/", ["prod_without_https.exs"], ["prod_without_https.exs"])
+    assert Sobelow.FindingLog.json("1") =~ "Config.HTTPS: HTTPS Not Enabled"
+  end
+end

test/fixtures/https/prod.exs

@@ -0,0 +1,4 @@
+use Config
+
+config :phoenix_app,
+  force_ssl: [hsts: true]

test/fixtures/https/prod_without_https.exs

@@ -0,0 +1,4 @@
+use Config
+
+config :phoenix_app,
+  logger: :info

test/fixtures/https/runtime.exs

@@ -0,0 +1,4 @@
+use Config
+
+config :phoenix_app,
+  force_ssl: [hsts: true]