Azure / Azure/template-analyzer
[RULE REQ] Fix rules looking for properties in web/config resources that don't check the config name
- Dominant language
- C#
- Stars
- 143
- Forks
- 47
- PR merge metrics
- No merged PRs in 30d
Description
### Please describe the new rule.
These rules should check the name of the config object before requiring the properties they check:
- Rules verifying use of TLS 1.2 (TA-000005, TA-000011, TA-000017)
- Rules verifying use of FTPS (TA-000003, TA-000009, TA-000015)
Example change:
```diff
"anyOf": [
{
"resourceType": "Microsoft.Web/sites/config",
+ "where": {
+ "path": "name",
+ "equals": "web"
+ },
"path": "properties.minTlsVersion",
"equals": "1.2"
},
{
"path": "properties.siteConfig.minTlsVersion",
"equals": "1.2"
}
]
```
### Additional context
The properties required by the rules are only valid for web configs. Requiring them on any config can result in overreporting of violations, where configs that are not applicable are reported as also violating the rule alongside configs that actually do violate it.
Contributor guide
Research direction
Start by locating the definitions for rules TA-000003, TA-000005, TA-000009, TA-000011, TA-000015, and TA-000017. Review their Microsoft.Web/sites/config checks and apply the demonstrated name condition so web-only properties are required only for the web config; done means unrelated config objects are no longer reported for these violations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100