fix(query): fixed 59cb3da7-f206-4ae6-b827-7abf0a9cab9d and 2ade1579-…

…4b2c-4590-bebb-f99bf597f612 Checkmarx#4435
noamd-legit · Nov 2, 2021 · bfd4dac · bfd4dac
1 parent 2f3c7c9
commit bfd4dac
Show file tree

Hide file tree

Showing 20 changed files with 95 additions and 26 deletions.
diff --git a/assets/libraries/azureresourcemanager.rego b/assets/libraries/azureresourcemanager.rego
@@ -2,16 +2,7 @@ package generic.azureresourcemanager
 
 # gets the network security group properties for two types of resource ('Microsoft.Network/networkSecurityGroups' and 'Microsoft.Network/networkSecurityGroups/securityRules')
 get_sg_info(value) = typeInfo {
-	value.type == "Microsoft.Network/networkSecurityGroups"
-	properties := value.properties.securityRules[x].properties
-	typeInfo := {
-		"type": value.type, 
-		"properties": properties, 
-		"path": "resources.type={{Microsoft.Network/networkSecurityGroups}}.properties.securityRules",
-		"sl": ["properties", "securityRules", x, "properties"]	
-	}
-} else = typeInfo {
-	value.type == "Microsoft.Network/networkSecurityGroups/securityRules"
+    value.type == "Microsoft.Network/networkSecurityGroups/securityRules"
 	typeInfo := {
 		"type": value.type, 
 		"properties": value.properties, 

diff --git a/...es/azureResourceManager/network_security_group_with_unrestricted_access_to_rdp/query.rego b/...es/azureResourceManager/network_security_group_with_unrestricted_access_to_rdp/query.rego
@@ -3,6 +3,30 @@ package Cx
 import data.generic.azureresourcemanager as arm_lib
 import data.generic.common as common_lib
 
+CxPolicy[result] {
+	doc := input.document[i]
+	[path, value] = walk(doc)
+
+	value.type == "Microsoft.Network/networkSecurityGroups"
+
+	properties := value.properties.securityRules[x].properties
+
+	properties.access == "Allow"
+	properties.protocol == "Tcp"
+	properties.direction == "Inbound"
+	arm_lib.contains_port(properties, 3389)
+	arm_lib.source_address_prefix_is_open(properties)
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("%s.name={{%s}}.properties.securityRules", [common_lib.concat_path(path), value.name]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": sprintf("resource with type '%s' restricts access to RDP", [value.type]),
+		"keyActualValue": sprintf("resource with type '%s' does not restrict access to RDP", [value.type]),
+		"searchLine": common_lib.build_search_line(path, ["properties", "securityRules", x, "properties"]),
+	}
+}
+
 CxPolicy[result] {
 	doc := input.document[i]
 	[path, value] = walk(doc)

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_rdp/test/negative2.json b/...esourceManager/network_security_group_with_unrestricted_access_to_rdp/test/negative2.json
@@ -11,7 +11,7 @@
       "type": "Microsoft.Network/networkSecurityGroups/securityRules",
       "apiVersion": "2020-11-01",
       "properties": {
-        "description": "access to RDP",
+        "description": "access",
         "protocol": "Tcp",
         "sourcePortRange": "*",
         "destinationPortRanges": [

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_rdp/test/negative3.json b/...esourceManager/network_security_group_with_unrestricted_access_to_rdp/test/negative3.json
@@ -18,7 +18,7 @@
           "type": "securityRules",
           "apiVersion": "2020-11-01",
           "properties": {
-            "description": "access to RDP",
+            "description": "access",
             "protocol": "Tcp",
             "sourcePortRange": "*",
             "destinationPortRanges": [

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_rdp/test/negative5.json b/...esourceManager/network_security_group_with_unrestricted_access_to_rdp/test/negative5.json
@@ -13,7 +13,7 @@
           "type": "Microsoft.Network/networkSecurityGroups/securityRules",
           "apiVersion": "2020-11-01",
           "properties": {
-            "description": "access to RDP",
+            "description": "access",
             "protocol": "Tcp",
             "sourcePortRange": "*",
             "destinationPortRanges": [

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_rdp/test/negative6.json b/...esourceManager/network_security_group_with_unrestricted_access_to_rdp/test/negative6.json
@@ -20,7 +20,7 @@
               "type": "securityRules",
               "apiVersion": "2020-11-01",
               "properties": {
-                "description": "access to RDP",
+                "description": "access",
                 "protocol": "Tcp",
                 "sourcePortRange": "*",
                 "destinationPortRanges": [

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_rdp/test/positive1.json b/...esourceManager/network_security_group_with_unrestricted_access_to_rdp/test/positive1.json
@@ -28,6 +28,21 @@
               "direction": "Inbound"
             },
             "name": "security rule"
+          },
+          {
+            "id": "id2",
+            "properties": {
+              "description": "access to SSH",
+              "protocol": "Tcp",
+              "sourcePortRange": "*",
+              "destinationPortRange": "22",
+              "sourceAddressPrefix": "*",
+              "destinationAddressPrefix": "*",
+              "access": "Deny",
+              "priority": 301,
+              "direction": "Inbound"
+            },
+            "name": "security rule2"
           }
         ]
       },

diff --git a/...es/azureResourceManager/network_security_group_with_unrestricted_access_to_ssh/query.rego b/...es/azureResourceManager/network_security_group_with_unrestricted_access_to_ssh/query.rego
@@ -3,6 +3,30 @@ package Cx
 import data.generic.azureresourcemanager as arm_lib
 import data.generic.common as common_lib
 
+CxPolicy[result] {
+	doc := input.document[i]
+	[path, value] = walk(doc)
+
+	value.type == "Microsoft.Network/networkSecurityGroups"
+
+	properties := value.properties.securityRules[x].properties
+
+	properties.access == "Allow"
+	properties.protocol == "Tcp"
+	properties.direction == "Inbound"
+	arm_lib.contains_port(properties, 22)
+	arm_lib.source_address_prefix_is_open(properties)
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("%s.name={{%s}}.properties.securityRules", [common_lib.concat_path(path), value.name]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": sprintf("resource with type '%s' restricts access to SSH", [value.type]),
+		"keyActualValue": sprintf("resource with type '%s' does not restrict access to SSH", [value.type]),
+		"searchLine": common_lib.build_search_line(path, ["properties", "securityRules", x, "properties"]),
+	}
+}
+
 CxPolicy[result] {
 	doc := input.document[i]
 	[path, value] = walk(doc)

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/negative1.json b/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/negative1.json
@@ -17,7 +17,7 @@
           {
             "id": "id",
             "properties": {
-              "description": "access to RDP",
+              "description": "access to SSH",
               "protocol": "Tcp",
               "sourcePortRange": "*",
               "destinationPortRange": "22",

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/negative2.json b/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/negative2.json
@@ -11,7 +11,7 @@
       "type": "Microsoft.Network/networkSecurityGroups/securityRules",
       "apiVersion": "2020-11-01",
       "properties": {
-        "description": "access to RDP",
+        "description": "access",
         "protocol": "Tcp",
         "sourcePortRange": "*",
         "destinationPortRanges": [

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/negative3.json b/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/negative3.json
@@ -18,7 +18,7 @@
           "type": "securityRules",
           "apiVersion": "2020-11-01",
           "properties": {
-            "description": "access to RDP",
+            "description": "access",
             "protocol": "Tcp",
             "sourcePortRange": "*",
             "destinationPortRanges": [

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/negative4.json b/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/negative4.json
@@ -19,7 +19,7 @@
               {
                 "id": "id",
                 "properties": {
-                  "description": "access to RDP",
+                  "description": "access to SSH",
                   "protocol": "Tcp",
                   "sourcePortRange": "*",
                   "destinationPortRange": "22",

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/negative5.json b/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/negative5.json
@@ -13,7 +13,7 @@
           "type": "Microsoft.Network/networkSecurityGroups/securityRules",
           "apiVersion": "2020-11-01",
           "properties": {
-            "description": "access to RDP",
+            "description": "access",
             "protocol": "Tcp",
             "sourcePortRange": "*",
             "destinationPortRanges": [

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/negative6.json b/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/negative6.json
@@ -20,7 +20,7 @@
               "type": "securityRules",
               "apiVersion": "2020-11-01",
               "properties": {
-                "description": "access to RDP",
+                "description": "access",
                 "protocol": "Tcp",
                 "sourcePortRange": "*",
                 "destinationPortRanges": [

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/positive1.json b/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/positive1.json
@@ -17,7 +17,7 @@
           {
             "id": "id",
             "properties": {
-              "description": "access to RDP",
+              "description": "access to SSH",
               "protocol": "Tcp",
               "sourcePortRange": "*",
               "destinationPortRange": "22",
@@ -28,6 +28,21 @@
               "direction": "Inbound"
             },
             "name": "security rule"
+          },
+           {
+            "id": "id2",
+            "properties": {
+              "description": "access to RDP",
+              "protocol": "Tcp",
+              "sourcePortRange": "*",
+              "destinationPortRange": "3389",
+              "sourceAddressPrefix": "*",
+              "destinationAddressPrefix": "*",
+              "access": "Deny",
+              "priority": 301,
+              "direction": "Inbound"
+            },
+            "name": "security rule2"
           }
         ]
       },

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/positive2.json b/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/positive2.json
@@ -11,7 +11,7 @@
       "type": "Microsoft.Network/networkSecurityGroups/securityRules",
       "apiVersion": "2020-11-01",
       "properties": {
-        "description": "access to RDP",
+        "description": "access to SSH",
         "protocol": "Tcp",
         "sourcePortRange": "*",
         "destinationPortRanges": [

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/positive3.json b/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/positive3.json
@@ -18,7 +18,7 @@
           "type": "securityRules",
           "apiVersion": "2020-11-01",
           "properties": {
-            "description": "access to RDP",
+            "description": "access to SSH",
             "protocol": "Tcp",
             "sourcePortRange": "*",
             "destinationPortRanges": [

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/positive4.json b/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/positive4.json
@@ -19,7 +19,7 @@
               {
                 "id": "id",
                 "properties": {
-                  "description": "access to RDP",
+                  "description": "access to SSH",
                   "protocol": "Tcp",
                   "sourcePortRange": "*",
                   "destinationPortRange": "22",

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/positive5.json b/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/positive5.json
@@ -13,7 +13,7 @@
           "type": "Microsoft.Network/networkSecurityGroups/securityRules",
           "apiVersion": "2020-11-01",
           "properties": {
-            "description": "access to RDP",
+            "description": "access to SSH",
             "protocol": "Tcp",
             "sourcePortRange": "*",
             "destinationPortRanges": [

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/positive6.json b/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/positive6.json
@@ -20,7 +20,7 @@
               "type": "securityRules",
               "apiVersion": "2020-11-01",
               "properties": {
-                "description": "access to RDP",
+                "description": "access to SSH",
                 "protocol": "Tcp",
                 "sourcePortRange": "*",
                 "destinationPortRanges": [