Azure / Azure/bicep

Linter rule should warn if using a secure variable in an unsecured input / output parameter

Open
#4,891 1 comment 0 reactions 0 assignees View on GitHub
devdiv enhancement story: linter rules
Dominant language
Bicep
Stars
3.6k
Forks
830
Avg merge
1d 21m
Merged PRs (30d)
79

Description

**Is your feature request related to a problem? Please describe.**

In the following example, `in` is a secure parameter. however when the value is returned in the `out` output variable, it is no longer secured.

A linter rule should catch and warn on this

```bicep
@secure()
param in string

output out string = in
```

A similar situation occurs if you pass a secured value to an unsecured input of a child module

child.bicep
```bicep
param unsecured string
```

parent.bicep
```bicep
@secure()
param secured string

module child 'child.bicep' = {
name: 'foo'
params: {
unsecured: secured
}
}

```

**Describe the solution you'd like**
The above cases should be caught by linter rules

Contributor guide

Open the contributing guide

Research direction

Start by locating the linter rule implementation and tests for secure parameters, outputs, and module parameters. Reproduce both examples in the issue, then define the warnings for exposing a secure value through an unsecured output or child-module input. Done means both cases are diagnosed by linter tests.

Written by the indexing model from the issue text.

Assessment

Domain
security, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.