Linter rule should warn if using a secure variable in an unsecured input / output parameter
- Dominant language
- Bicep
- Stars
- 3.6k
- Forks
- 830
- Avg merge
- 1d 21m
- Merged PRs (30d)
- 79
Description
**Is your feature request related to a problem? Please describe.**
In the following example, `in` is a secure parameter. however when the value is returned in the `out` output variable, it is no longer secured.
A linter rule should catch and warn on this
```bicep
@secure()
param in string
output out string = in
```
A similar situation occurs if you pass a secured value to an unsecured input of a child module
child.bicep
```bicep
param unsecured string
```
parent.bicep
```bicep
@secure()
param secured string
module child 'child.bicep' = {
name: 'foo'
params: {
unsecured: secured
}
}
```
**Describe the solution you'd like**
The above cases should be caught by linter rules
Contributor guide
Research direction
Start by locating the linter rule implementation and tests for secure parameters, outputs, and module parameters. Reproduce both examples in the issue, then define the warnings for exposing a secure value through an unsecured output or child-module input. Done means both cases are diagnosed by linter tests.
Written by the indexing model from the issue text.
Assessment
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100