Skip to content

Commit

Permalink
Create rule S4423: add language AzureResourceManager (#1835)
Browse files Browse the repository at this point in the history
  • Loading branch information
egon-okerman-sonarsource authored May 11, 2023
1 parent 40d09d2 commit 42f4fbd
Show file tree
Hide file tree
Showing 4 changed files with 147 additions and 0 deletions.
2 changes: 2 additions & 0 deletions rules/S4423/azureresourcemanager/highlighting.adoc
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
* Highlight `minimumTlsVersion`/`minimalTlsVersion` if it is specified but has the wrong value
* Highlight resource if `minimumTlsVersion`/`minimalTlsVersion` is not specified at all
5 changes: 5 additions & 0 deletions rules/S4423/azureresourcemanager/message.adoc
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
* If `minimumTlsVersion`/`minimalTlsVersion` is specified but has the wrong value
** Change this code to disable support of older TLS versions.
* If `minimumTlsVersion`/`minimalTlsVersion` is not specified at all
** Set `minimumTlsVersion`/`minimalTlsVersion` to disable support of older TLS versions.
32 changes: 32 additions & 0 deletions rules/S4423/azureresourcemanager/metadata.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
{
"tags": [
"azure",
"cwe",
"privacy"
],
"securityStandards": {
"CWE": [
327,
326,
295
],
"OWASP": [
],
"OWASP Mobile": [
],
"MASVS": [
],
"OWASP Top 10 2021": [
],
"PCI DSS 3.2": [
"4.1",
"6.5.4"
],
"PCI DSS 4.0": [
"4.2.1",
"6.2.4"
],
"ASVS 4.0": [
]
}
}
108 changes: 108 additions & 0 deletions rules/S4423/azureresourcemanager/rule.adoc
Original file line number Diff line number Diff line change
@@ -0,0 +1,108 @@
== Why is this an issue?

include::../description.adoc[]

=== Noncompliant code example

For https://learn.microsoft.com/en-us/azure/templates/microsoft.storage/storageaccounts[Azure Storage accounts], TLS 1.0 and 1.1 are accepted by default.

[source,json,diff-id=2,diff-type=noncompliant]
----
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Storage/storageAccounts",
"apiVersion": "2022-09-01",
"name": "example",
"properties": {
"minimumTlsVersion": "TLS1_0"
}
}
]
}
----

For https://learn.microsoft.com/en-us/azure/templates/microsoft.dbformysql/servers[Azure Database for MySQL servers], https://learn.microsoft.com/en-us/azure/templates/microsoft.dbforpostgresql/servers[Azure Database for PostgreSQL servers], and https://learn.microsoft.com/en-us/azure/templates/microsoft.dbformariadb/servers[Azure Database for MariaDB servers], there is no minimal TLS version enforced by default.

[source,json,diff-id=4,diff-type=noncompliant]
----
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.DBforMySQL/servers",
"apiVersion": "2017-12-01",
"name": "example",
"properties": {
"minimalTlsVersion": "TLS1_0"
}
}
]
}
----

== Compliant Solution

For https://learn.microsoft.com/en-us/azure/templates/microsoft.storage/storageaccounts[Azure Storage accounts]:

[source,json,diff-id=2,diff-type=compliant]
----
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Storage/storageAccounts",
"apiVersion": "2022-09-01",
"name": "example",
"properties": {
"minimumTlsVersion": "TLS1_2"
}
}
]
}
----

For https://learn.microsoft.com/en-us/azure/templates/microsoft.dbformysql/servers[Azure Database for MySQL servers], https://learn.microsoft.com/en-us/azure/templates/microsoft.dbforpostgresql/servers[Azure Database for PostgreSQL servers], and https://learn.microsoft.com/en-us/azure/templates/microsoft.dbformariadb/servers[Azure Database for MariaDB servers]:

[source,json,diff-id=4,diff-type=compliant]
----
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.DBforMySQL/servers",
"apiVersion": "2017-12-01",
"name": "example",
"properties": {
"minimalTlsVersion": "TLS1_2"
}
}
]
}
----

include::../see.adoc[]

* https://learn.microsoft.com/en-us/azure/azure-sql/database/connectivity-settings#minimal-tls-version[Microsoft Learn] - Azure SQL - Minimal TLS version

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::message.adoc[]

include::highlighting.adoc[]

'''
== Comments And Links
(visible only on this page)

include::../comments-and-links.adoc[]
endif::env-github,rspecator-view[]

0 comments on commit 42f4fbd

Please sign in to comment.