Azure / Azure/arm-ttk

URIs Should Be Properly Constructed Triggers When Referencing KeyVault Secret

Open
#724 2 comments 1 reaction 0 assignees View on GitHub
Needs: triage :mag:
Dominant language
PowerShell
Stars
468
Forks
208
PR merge metrics
No merged PRs in 30d

Description

Similar issues related to this rule have been reported several times; the most relevant ones seem to be #417, #713, #590 in all these cases they appear to be using a "bare" or "naked" Uri for which the recommended solution of `uri()` seems appropriate.

However, consider the following example ARM Template:

```json
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
},
"resources": [
{
"type": "Microsoft.Web/sites/config",
"apiVersion": "2022-03-01",
"name": "myCoolFunctionApp/appsettings",
"dependsOn": [
"[resourceId('Microsoft.KeyVault/vaults', 'mycoolKeyVault')]",
"[resourceId('Microsoft.KeyVault/vaults/secrets', 'mycoolKeyVault', 'some-secret')]",
"[resourceId('Microsoft.KeyVault/vaults/secrets', 'mycoolKeyVault', 'some-other-secret')]",
"[resourceId('Microsoft.Web/sites', 'myCoolFunctionApp')]"
],
"properties": {
"Some:SecretUri": "[concat('@Microsoft.KeyVault(SecretUri=', reference(resourceId('Microsoft.KeyVault/vaults/secrets', 'mycoolKeyVault', 'some-secret')).secretUri, ')')]",
"Some:OtherUriSecret": "[concat('@Microsoft.KeyVault(SecretUri=', reference(resourceId('Microsoft.KeyVault/vaults/secrets', 'mycoolKeyVault', 'some-other-secret')).secretUri, ')')]",
"SecretUrl": "[format('@Microsoft.KeyVault(SecretUri={0})', reference(resourceId('Microsoft.KeyVault/vaults/secrets', 'mycoolKeyVault', 'some-other-secret')).secretUri)]"
}
}
]
}
```

This is using the Azure KeyVault Reference Syntax Documented here: https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references?tabs=azure-cli#reference-syntax. Both syntaxes will trigger the warning:

```
URIs Should Be Properly Constructed
[-] URIs Should Be Properly Constructed (11 ms)
Function 'concat' found within 'Some:SecretUri'
Function 'format' found within 'SecretUrl'
Function 'concat' found within 'Some:SecretUri' Line: 20, Column: 18
Function 'format' found within 'SecretUrl' Line: 20, Column: 18
```

Is there an alternate way that the Referenced Secret Syntax should be utilized that avoids this linter error? Even the alternative syntax `@Microsoft.KeyVault(VaultName=myvault;SecretName=mysecret)` will throw because you're still going to need to use `concat()` or `format()` to accomplish this.

The real problem seems to be the detection of what is considered a URI, it appears to only considers properties that end in `Uri` or `Url` which is not a bad heuristic.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by running the supplied ARM template through the URI rule and compare the warnings for the concat() and format() Key Vault reference forms. Trace how the rule identifies URI-like properties; done should distinguish documented Key Vault reference syntax from improperly constructed URIs without losing the existing warning behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud, security, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.