feat(general): Allow skipping multiple checks in a single line

checkov/common/comment/enum.py

@@ -1,3 +1,3 @@
 import re
 
-COMMENT_REGEX = re.compile(r'(checkov:skip=|bridgecrew:skip=) *([A-Za-z_\d]+)(:[^\n]+)?')
+COMMENT_REGEX = re.compile(r'(checkov:skip=|bridgecrew:skip=) *([A-Za-z_\d]+(?:,[A-Za-z_\d]+)*)*(:[^\n]+)?')

checkov/terraform/context_parsers/base_parser.py

@@ -91,7 +91,7 @@ def _collect_skip_comments(self, definition_blocks: List[Dict[str, Any]]) -> Dic
         """
         Collects checkov skip comments to all definition blocks
         :param definition_blocks: parsed definition blocks
-        :return: context enriched with with skipped checks per skipped entity
+        :return: context enriched with skipped checks per skipped entity
         """
         bc_id_mapping = metadata_integration.bc_to_ckv_id_mapping
         comments = [
@@ -125,12 +125,16 @@ def _collect_skip_comments(self, definition_blocks: List[Dict[str, Any]]) -> Dic
                 if "start_line" in entity_context and "end_line" in entity_context \
                         and entity_context["start_line"] < skip_check_line_num < entity_context["end_line"]:
                     # No matter which ID was used to skip, save the pair of IDs in the appropriate fields
-                    if bc_id_mapping and skip_check["id"] in bc_id_mapping:
-                        skip_check["bc_id"] = skip_check["id"]
-                        skip_check["id"] = bc_id_mapping[skip_check["id"]]
-                    elif metadata_integration.check_metadata:
-                        skip_check["bc_id"] = metadata_integration.get_bc_id(skip_check["id"])
-                    skipped_checks.append(skip_check)
+                    skip_check_ids = skip_check["id"].split(',')
+                    for skip_check_id in skip_check_ids:
+                        single_skip_check = {"id": skip_check_id.strip(),
+                                             "suppress_comment": skip_check["suppress_comment"]}
+                        if bc_id_mapping and single_skip_check["id"] in bc_id_mapping:
+                            single_skip_check["bc_id"] = single_skip_check["id"]
+                            single_skip_check["id"] = bc_id_mapping[single_skip_check["id"]]
+                        elif metadata_integration.check_metadata:
+                            single_skip_check["bc_id"] = metadata_integration.get_bc_id(skip_check["id"])
+                        skipped_checks.append(single_skip_check)
             dpath.new(self.context, entity_context_path + ["skipped_checks"], skipped_checks)
         return self.context
 

tests/terraform/checks/a example skip/main.tf

@@ -0,0 +1,27 @@
+
+resource "azurerm_storage_account" "default" {
+  #checkov:skip=CKV_AZURE_33
+  name                     = "storageaccountname"
+  resource_group_name      = "azurerm_resource_group.example.name"
+  location                 = "azurerm_resource_group.example.location"
+  account_tier             = "Standard"
+  account_replication_type = "GRS"
+}
+
+resource "azurerm_storage_account" "skip_more_than_one" {
+  #checkov:skip=CKV_AZURE_33,CKV_AZURE_59: Skipped by user
+  name                     = "storageaccountname"
+  resource_group_name      = "azurerm_resource_group.example.name"
+  location                 = "azurerm_resource_group.example.location"
+  account_tier             = "Standard"
+  account_replication_type = "GRS"
+}
+
+resource "azurerm_storage_account" "skip_invalid" {
+  #checkov:skip=CKV_AZURE_33,bla bla bla: Skipped by user
+  name                     = "storageaccountname"
+  resource_group_name      = "azurerm_resource_group.example.name"
+  location                 = "azurerm_resource_group.example.location"
+  account_tier             = "Standard"
+  account_replication_type = "GRS"
+}

tests/terraform/checks/test_multiple_skips.py

@@ -0,0 +1,27 @@
+import unittest
+from pathlib import Path
+
+from checkov.runner_filter import RunnerFilter
+from checkov.terraform.runner import Runner
+
+
+class TestMultipleSkips(unittest.TestCase):
+
+    def test(self) -> None:
+        # given
+        test_files_dir = Path(__file__).parent / "a example skip"
+
+        # when
+        report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[]))
+
+        # then
+        summary = report.get_summary()
+
+        self.assertEqual(summary["passed"], 12)
+        self.assertEqual(summary["failed"], 26)
+        self.assertEqual(summary["skipped"], 4)
+        self.assertEqual(summary["parsing_errors"], 0)
+
+
+if __name__ == "__main__":
+    unittest.main()