Azure / Azure/template-analyzer

[RULE REQ] Fix rules looking for properties in web/config resources that don't check the config name

Open
#251 0 comments 0 reactions 0 assignees View on GitHub
built-in rule
Dominant language
C#
Stars
143
Forks
47
PR merge metrics
No merged PRs in 30d

Description

### Please describe the new rule.

These rules should check the name of the config object before requiring the properties they check:
- Rules verifying use of TLS 1.2 (TA-000005, TA-000011, TA-000017)
- Rules verifying use of FTPS (TA-000003, TA-000009, TA-000015)

Example change:
```diff
"anyOf": [
{
"resourceType": "Microsoft.Web/sites/config",
+ "where": {
+ "path": "name",
+ "equals": "web"
+ },
"path": "properties.minTlsVersion",
"equals": "1.2"
},
{
"path": "properties.siteConfig.minTlsVersion",
"equals": "1.2"
}
]
```

### Additional context

The properties required by the rules are only valid for web configs. Requiring them on any config can result in overreporting of violations, where configs that are not applicable are reported as also violating the rule alongside configs that actually do violate it.

Contributor guide

Open the contributing guide

Research direction

Start by locating the definitions for rules TA-000003, TA-000005, TA-000009, TA-000011, TA-000015, and TA-000017. Review their Microsoft.Web/sites/config checks and apply the demonstrated name condition so web-only properties are required only for the web config; done means unrelated config objects are no longer reported for these violations.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.