ishangsf/rspec
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Modify Rule S6382: Fix outdated properties (APPSEC-773) (#2514)

Browse Source 
* Fix outdated property

* Swap Web Apps for Containers and App Service
This commit is contained in:
Egon Okerman 2024-09-11 10:37:08 +02:00 committed by GitHub
parent 0e30d8dfd4
commit a3a2e69a45
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 22 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/S6382/terraform/highlighting.adoc
View File

@ -3,4 +3,4 @@
* If one (out of one) assignment is missing: Highlight the resource
* If an assignment is security-sensitive: Highlight the assignment
* For `linux_web_app` and `windows_web_app`:
** If both assignments are present and security-sensitive: Highlight `client_cert_enabled = false`
** If both assignments are present and security-sensitive: Highlight `client_certificate_enabled = false`

8
rules/S6382/terraform/message.adoc
View File

@ -7,15 +7,19 @@ For these resources:
* `data_factory_linked_service_sftp`
* `data_factory_linked_service_web`
* `linux_web_app`
* `windows_web_app` (if both parameters are non-compliant, flag `client_cert_enabled` first)
* `windows_web_app` (if both parameters are non-compliant, flag `client_certificate_enabled` first)
These messages apply:
* If an assignment is missing: Omitting {property_name} disables certificate-based authentication. Make sure it is safe here.
* If the assignment is security-sensitive: Make sure that disabling certificate-based authentication is safe here.
* For `function_app` and `logic_app_standard`:
* For `function_app`:
** Omitting `client_cert_mode` makes certificate-based authentication optional. Make sure it is safe here.
** Make sure that setting certificate-based authentication as optional is safe here.
* For `logic_app_standard`:
** Omitting `client_certificate_mode` makes certificate-based authentication optional. Make sure it is safe here.
** Make sure that setting certificate-based authentication as optional is safe here.
Make sure that disabling certificate-based authentication is safe here.

28
rules/S6382/terraform/rule.adoc
View File

@ -6,13 +6,17 @@ include::../common/recommended.adoc[]
== Sensitive Code Example
For https://azure.microsoft.com/en-us/services/app-service/[App Service]:
For https://azure.microsoft.com/en-us/services/app-service/containers/[Linux and Windows Web Apps]:
[source,terraform,diff-id=1,diff-type=noncompliant]
----
resource "azurerm_app_service" "example" {
resource "azurerm_linux_web_app" "example" {
client_cert_enabled = false # Sensitive
}
resource "azurerm_linux_web_app" "example2" {
client_certificate_enabled = true
client_certificate_mode = "Optional" # Sensitive
}
----
For https://azure.microsoft.com/en-us/services/logic-apps/[Logic App Standards] and https://azure.microsoft.com/en-us/services/functions/[Function Apps]:
@ -43,27 +47,24 @@ resource "azurerm_api_management" "example" {
}
----
For https://azure.microsoft.com/en-us/services/app-service/containers/[Linux and Windows Web Apps]:
For https://azure.microsoft.com/en-us/services/app-service/[App Service]:
[source,terraform,diff-id=5,diff-type=noncompliant]
----
resource "azurerm_linux_web_app" "example" {
resource "azurerm_app_service" "example" {
client_cert_enabled = false # Sensitive
}
resource "azurerm_linux_web_app" "exemple2" {
client_cert_enabled = true
client_cert_mode = "Optional" # Sensitive
}
----
== Compliant Solution
For https://azure.microsoft.com/en-us/services/app-service/[App Service]:
For https://azure.microsoft.com/en-us/services/app-service/containers/[Linux and Windows Web Apps]:
[source,terraform,diff-id=1,diff-type=compliant]
----
resource "azurerm_app_service" "example" {
client_cert_enabled = true
resource "azurerm_linux_web_app" "example" {
client_certificate_enabled = true
client_certificate_mode = "Required"
}
----
@ -95,13 +96,12 @@ resource "azurerm_api_management" "example" {
}
----
For https://azure.microsoft.com/en-us/services/app-service/containers/[Linux and Windows Web Apps]:
For https://azure.microsoft.com/en-us/services/app-service/[App Service]:
[source,terraform,diff-id=5,diff-type=compliant]
----
resource "azurerm_linux_web_app" "exemple" {
resource "azurerm_app_service" "example" {
client_cert_enabled = true
client_cert_mode = "Required"
}
----