Skip to content

Commit c6d95d7

Browse files
yagreutnikpivkin
yagreut
and
nikpivkin
authored
feat(misconf): Update AppService schema (#9792)
Signed-off-by: nikpivkin <[email protected]> Co-authored-by: Nikita Pivkin <[email protected]>
1 parent a6ceff7 commit c6d95d7

File tree

8 files changed

+119
-119
lines changed

8 files changed

+119
-119
lines changed

‎pkg/iac/adapters/arm/appservice/adapt.go‎

Lines changed: 22 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ package appservice
33
import (
44
"github.com/aquasecurity/trivy/pkg/iac/providers/azure/appservice"
55
"github.com/aquasecurity/trivy/pkg/iac/scanners/azure"
6-
iacTypes "github.com/aquasecurity/trivy/pkg/iac/types"
76
)
87

98
func Adapt(deployment azure.Deployment) appservice.AppService {
@@ -32,27 +31,36 @@ func adaptServices(deployment azure.Deployment) []appservice.Service {
3231

3332
func adaptFunctionApp(resource azure.Resource) appservice.FunctionApp {
3433
return appservice.FunctionApp{
35-
Metadata: resource.Metadata,
36-
HTTPSOnly: resource.Properties.GetMapValue("httpsOnly").AsBoolValue(false, resource.Properties.GetMetadata()),
34+
Metadata: resource.Metadata,
35+
HTTPSOnly: resource.Properties.GetMapValue("httpsOnly").
36+
AsBoolValue(false, resource.Properties.GetMetadata()),
3737
}
3838
}
3939

4040
func adaptService(resource azure.Resource) appservice.Service {
41+
props := resource.Properties
42+
identity := props.GetMapValue("identity")
43+
siteAuthSettings := props.GetMapValue("siteAuthSettings")
44+
siteConfig := props.GetMapValue("siteConfig")
4145
return appservice.Service{
4246
Metadata: resource.Metadata,
43-
EnableClientCert: resource.Properties.GetMapValue("clientCertEnabled").AsBoolValue(false, resource.Properties.GetMetadata()),
44-
Identity: struct{ Type iacTypes.StringValue }{
45-
Type: resource.Properties.GetMapValue("identity").GetMapValue("type").AsStringValue("", resource.Properties.GetMetadata()),
47+
EnableClientCert: props.GetMapValue("clientCertEnabled").AsBoolValue(false, props.GetMetadata()),
48+
HTTPSOnly: props.GetMapValue("httpsOnly").AsBoolValue(false, props.GetMetadata()),
49+
Identity: appservice.Identity{
50+
Metadata: identity.GetMetadata(),
51+
Type: identity.GetMapValue("type").
52+
AsStringValue("", props.GetMetadata()),
4653
},
47-
Authentication: struct{ Enabled iacTypes.BoolValue }{
48-
Enabled: resource.Properties.GetMapValue("siteAuthSettings").GetMapValue("enabled").AsBoolValue(false, resource.Properties.GetMetadata()),
54+
Authentication: appservice.Authentication{
55+
Metadata: siteAuthSettings.GetMetadata(),
56+
Enabled: siteAuthSettings.GetMapValue("enabled").AsBoolValue(false, props.GetMetadata()),
4957
},
50-
Site: struct {
51-
EnableHTTP2 iacTypes.BoolValue
52-
MinimumTLSVersion iacTypes.StringValue
53-
}{
54-
EnableHTTP2: resource.Properties.GetMapValue("httpsOnly").AsBoolValue(false, resource.Properties.GetMetadata()),
55-
MinimumTLSVersion: resource.Properties.GetMapValue("minTlsVersion").AsStringValue("", resource.Properties.GetMetadata()),
58+
Site: appservice.Site{
59+
EnableHTTP2: siteConfig.GetMapValue("http20Enabled").AsBoolValue(false, siteConfig.GetMetadata()),
60+
MinimumTLSVersion: siteConfig.GetMapValue("minTlsVersion").AsStringValue("", siteConfig.GetMetadata()),
61+
PHPVersion: siteConfig.GetMapValue("phpVersion").AsStringValue("", siteConfig.GetMetadata()),
62+
PythonVersion: siteConfig.GetMapValue("pythonVersion").AsStringValue("", siteConfig.GetMetadata()),
63+
FTPSState: siteConfig.GetMapValue("ftpsState").AsStringValue("", siteConfig.GetMetadata()),
5664
},
5765
}
5866
}

‎pkg/iac/adapters/arm/appservice/adapt_test.go‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,8 @@ func TestAdapt(t *testing.T) {
2525
]
2626
}`,
2727
expected: appservice.AppService{
28-
FunctionApps: []appservice.FunctionApp{{}},
2928
Services: []appservice.Service{{}},
29+
FunctionApps: []appservice.FunctionApp{{}},
3030
},
3131
},
3232
{
@@ -44,26 +44,34 @@ func TestAdapt(t *testing.T) {
4444
"siteAuthSettings": {
4545
"enabled": true
4646
},
47-
"minTlsVersion": "1.3"
47+
"minTlsVersion": "1.3",
48+
"siteConfig": {
49+
"http20Enabled": true,
50+
"minTlsVersion": "1.2",
51+
"phpVersion": "8.1",
52+
"pythonVersion": "3.11",
53+
"ftpsState": "FtpsOnly"
54+
}
4855
}
4956
}
5057
]
5158
}`,
5259
expected: appservice.AppService{
5360
Services: []appservice.Service{{
5461
EnableClientCert: types.BoolTest(true),
55-
Identity: struct{ Type types.StringValue }{
62+
HTTPSOnly: types.BoolTest(true),
63+
Identity: appservice.Identity{
5664
Type: types.StringTest("SystemAssigned"),
5765
},
58-
Authentication: struct{ Enabled types.BoolValue }{
66+
Authentication: appservice.Authentication{
5967
Enabled: types.BoolTest(true),
6068
},
61-
Site: struct {
62-
EnableHTTP2 types.BoolValue
63-
MinimumTLSVersion types.StringValue
64-
}{
69+
Site: appservice.Site{
6570
EnableHTTP2: types.BoolTest(true),
66-
MinimumTLSVersion: types.StringTest("1.3"),
71+
MinimumTLSVersion: types.StringTest("1.2"),
72+
PHPVersion: types.StringTest("8.1"),
73+
PythonVersion: types.StringTest("3.11"),
74+
FTPSState: types.StringTest("FtpsOnly"),
6775
},
6876
}},
6977
FunctionApps: []appservice.FunctionApp{{
@@ -78,5 +86,4 @@ func TestAdapt(t *testing.T) {
7886
adaptertest.AdaptAndCompare(t, tt.source, tt.expected, Adapt)
7987
})
8088
}
81-
8289
}

‎pkg/iac/adapters/terraform/azure/appservice/adapt.go‎

Lines changed: 23 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
package appservice
22

33
import (
4+
"github.com/samber/lo"
5+
46
"github.com/aquasecurity/trivy/pkg/iac/providers/azure/appservice"
57
"github.com/aquasecurity/trivy/pkg/iac/terraform"
6-
iacTypes "github.com/aquasecurity/trivy/pkg/iac/types"
78
)
89

910
func Adapt(modules terraform.Modules) appservice.AppService {
@@ -15,80 +16,50 @@ func Adapt(modules terraform.Modules) appservice.AppService {
1516

1617
func adaptServices(modules terraform.Modules) []appservice.Service {
1718
var services []appservice.Service
18-
19-
for _, module := range modules {
20-
for _, resource := range module.GetResourcesByType("azurerm_app_service") {
21-
services = append(services, adaptService(resource))
22-
}
19+
for _, resource := range modules.GetResourcesByType("azurerm_app_service") {
20+
services = append(services, adaptService(resource))
2321
}
2422
return services
2523
}
2624

2725
func adaptFunctionApps(modules terraform.Modules) []appservice.FunctionApp {
2826
var functionApps []appservice.FunctionApp
29-
30-
for _, module := range modules {
31-
for _, resource := range module.GetResourcesByType("azurerm_function_app") {
32-
functionApps = append(functionApps, adaptFunctionApp(resource))
33-
}
27+
for _, resource := range modules.GetResourcesByType("azurerm_function_app") {
28+
functionApps = append(functionApps, adaptFunctionApp(resource))
3429
}
3530
return functionApps
3631
}
3732

3833
func adaptService(resource *terraform.Block) appservice.Service {
39-
enableClientCertAttr := resource.GetAttribute("client_cert_enabled")
40-
enableClientCertVal := enableClientCertAttr.AsBoolValueOrDefault(false, resource)
41-
34+
siteBlock := resource.GetBlock("site_config")
4235
identityBlock := resource.GetBlock("identity")
43-
typeVal := iacTypes.String("", resource.GetMetadata())
44-
if identityBlock.IsNotNil() {
45-
typeAttr := identityBlock.GetAttribute("type")
46-
typeVal = typeAttr.AsStringValueOrDefault("", identityBlock)
47-
}
48-
4936
authBlock := resource.GetBlock("auth_settings")
50-
enabledVal := iacTypes.Bool(false, resource.GetMetadata())
51-
if authBlock.IsNotNil() {
52-
enabledAttr := authBlock.GetAttribute("enabled")
53-
enabledVal = enabledAttr.AsBoolValueOrDefault(false, authBlock)
54-
}
55-
56-
siteBlock := resource.GetBlock("site_config")
57-
enableHTTP2Val := iacTypes.Bool(false, resource.GetMetadata())
58-
minTLSVersionVal := iacTypes.String("1.2", resource.GetMetadata())
59-
if siteBlock.IsNotNil() {
60-
enableHTTP2Attr := siteBlock.GetAttribute("http2_enabled")
61-
enableHTTP2Val = enableHTTP2Attr.AsBoolValueOrDefault(false, siteBlock)
62-
63-
minTLSVersionAttr := siteBlock.GetAttribute("min_tls_version")
64-
minTLSVersionVal = minTLSVersionAttr.AsStringValueOrDefault("1.2", siteBlock)
65-
}
66-
6737
return appservice.Service{
6838
Metadata: resource.GetMetadata(),
69-
EnableClientCert: enableClientCertVal,
70-
Identity: struct{ Type iacTypes.StringValue }{
71-
Type: typeVal,
39+
EnableClientCert: resource.GetAttribute("client_cert_enabled").AsBoolValueOrDefault(false, resource),
40+
HTTPSOnly: resource.GetAttribute("https_only").AsBoolValueOrDefault(false, resource),
41+
Identity: appservice.Identity{
42+
Metadata: lo.TernaryF(identityBlock.IsNil(), resource.GetMetadata, identityBlock.GetMetadata),
43+
Type: identityBlock.GetAttribute("type").AsStringValueOrDefault("", identityBlock),
7244
},
73-
Authentication: struct{ Enabled iacTypes.BoolValue }{
74-
Enabled: enabledVal,
45+
Authentication: appservice.Authentication{
46+
Metadata: lo.TernaryF(identityBlock.IsNil(), resource.GetMetadata, authBlock.GetMetadata),
47+
Enabled: authBlock.GetAttribute("enabled").AsBoolValueOrDefault(false, authBlock),
7548
},
76-
Site: struct {
77-
EnableHTTP2 iacTypes.BoolValue
78-
MinimumTLSVersion iacTypes.StringValue
79-
}{
80-
EnableHTTP2: enableHTTP2Val,
81-
MinimumTLSVersion: minTLSVersionVal,
49+
Site: appservice.Site{
50+
Metadata: lo.TernaryF(identityBlock.IsNil(), resource.GetMetadata, siteBlock.GetMetadata),
51+
EnableHTTP2: siteBlock.GetAttribute("http2_enabled").AsBoolValueOrDefault(false, siteBlock),
52+
MinimumTLSVersion: siteBlock.GetAttribute("min_tls_version").AsStringValueOrDefault("1.2", siteBlock),
53+
PHPVersion: siteBlock.GetAttribute("php_version").AsStringValueOrDefault("", siteBlock),
54+
PythonVersion: siteBlock.GetAttribute("python_version").AsStringValueOrDefault("", siteBlock),
55+
FTPSState: siteBlock.GetAttribute("ftps_state").AsStringValueOrDefault("", siteBlock),
8256
},
8357
}
8458
}
8559

8660
func adaptFunctionApp(resource *terraform.Block) appservice.FunctionApp {
87-
HTTPSOnlyAttr := resource.GetAttribute("https_only")
88-
HTTPSOnlyVal := HTTPSOnlyAttr.AsBoolValueOrDefault(false, resource)
89-
9061
return appservice.FunctionApp{
9162
Metadata: resource.GetMetadata(),
92-
HTTPSOnly: HTTPSOnlyVal,
63+
HTTPSOnly: resource.GetAttribute("https_only").AsBoolValueOrDefault(false, resource),
9364
}
9465
}

‎pkg/iac/adapters/terraform/azure/appservice/adapt_test.go‎

Lines changed: 12 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -40,20 +40,16 @@ func Test_adaptService(t *testing.T) {
4040
}
4141
`,
4242
expected: appservice.Service{
43-
Metadata: iacTypes.NewTestMetadata(),
44-
EnableClientCert: iacTypes.Bool(true, iacTypes.NewTestMetadata()),
45-
Identity: struct{ Type iacTypes.StringValue }{
46-
Type: iacTypes.String("UserAssigned", iacTypes.NewTestMetadata()),
43+
EnableClientCert: iacTypes.BoolTest(true),
44+
Identity: appservice.Identity{
45+
Type: iacTypes.StringTest("UserAssigned"),
4746
},
48-
Authentication: struct{ Enabled iacTypes.BoolValue }{
49-
Enabled: iacTypes.Bool(true, iacTypes.NewTestMetadata()),
47+
Authentication: appservice.Authentication{
48+
Enabled: iacTypes.BoolTest(true),
5049
},
51-
Site: struct {
52-
EnableHTTP2 iacTypes.BoolValue
53-
MinimumTLSVersion iacTypes.StringValue
54-
}{
55-
EnableHTTP2: iacTypes.Bool(true, iacTypes.NewTestMetadata()),
56-
MinimumTLSVersion: iacTypes.String("1.0", iacTypes.NewTestMetadata()),
50+
Site: appservice.Site{
51+
EnableHTTP2: iacTypes.BoolTest(true),
52+
MinimumTLSVersion: iacTypes.StringTest("1.0"),
5753
},
5854
},
5955
},
@@ -64,20 +60,8 @@ func Test_adaptService(t *testing.T) {
6460
}
6561
`,
6662
expected: appservice.Service{
67-
Metadata: iacTypes.NewTestMetadata(),
68-
EnableClientCert: iacTypes.Bool(false, iacTypes.NewTestMetadata()),
69-
Identity: struct{ Type iacTypes.StringValue }{
70-
Type: iacTypes.String("", iacTypes.NewTestMetadata()),
71-
},
72-
Authentication: struct{ Enabled iacTypes.BoolValue }{
73-
Enabled: iacTypes.Bool(false, iacTypes.NewTestMetadata()),
74-
},
75-
Site: struct {
76-
EnableHTTP2 iacTypes.BoolValue
77-
MinimumTLSVersion iacTypes.StringValue
78-
}{
79-
EnableHTTP2: iacTypes.Bool(false, iacTypes.NewTestMetadata()),
80-
MinimumTLSVersion: iacTypes.String("1.2", iacTypes.NewTestMetadata()),
63+
Site: appservice.Site{
64+
MinimumTLSVersion: iacTypes.StringTest("1.2"),
8165
},
8266
},
8367
},
@@ -107,8 +91,7 @@ func Test_adaptFunctionApp(t *testing.T) {
10791
}
10892
`,
10993
expected: appservice.FunctionApp{
110-
Metadata: iacTypes.NewTestMetadata(),
111-
HTTPSOnly: iacTypes.Bool(true, iacTypes.NewTestMetadata()),
94+
HTTPSOnly: iacTypes.BoolTest(true),
11295
},
11396
},
11497
{
@@ -118,8 +101,7 @@ func Test_adaptFunctionApp(t *testing.T) {
118101
}
119102
`,
120103
expected: appservice.FunctionApp{
121-
Metadata: iacTypes.NewTestMetadata(),
122-
HTTPSOnly: iacTypes.Bool(false, iacTypes.NewTestMetadata()),
104+
HTTPSOnly: iacTypes.BoolTest(false),
123105
},
124106
},
125107
}

‎pkg/iac/providers/azure/appservice/appservice.go‎

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,19 +9,32 @@ type AppService struct {
99
FunctionApps []FunctionApp
1010
}
1111

12+
type Identity struct {
13+
Metadata iacTypes.Metadata
14+
Type iacTypes.StringValue
15+
}
16+
17+
type Authentication struct {
18+
Metadata iacTypes.Metadata
19+
Enabled iacTypes.BoolValue
20+
}
21+
1222
type Service struct {
1323
Metadata iacTypes.Metadata
1424
EnableClientCert iacTypes.BoolValue
15-
Identity struct {
16-
Type iacTypes.StringValue
17-
}
18-
Authentication struct {
19-
Enabled iacTypes.BoolValue
20-
}
21-
Site struct {
22-
EnableHTTP2 iacTypes.BoolValue
23-
MinimumTLSVersion iacTypes.StringValue
24-
}
25+
HTTPSOnly iacTypes.BoolValue
26+
Identity Identity
27+
Authentication Authentication
28+
Site Site
29+
}
30+
31+
type Site struct {
32+
Metadata iacTypes.Metadata
33+
EnableHTTP2 iacTypes.BoolValue
34+
MinimumTLSVersion iacTypes.StringValue
35+
PHPVersion iacTypes.StringValue
36+
PythonVersion iacTypes.StringValue
37+
FTPSState iacTypes.StringValue
2538
}
2639

2740
type FunctionApp struct {

‎pkg/iac/rego/schemas/cloud.json‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4528,13 +4528,17 @@
45284528
"type": "object",
45294529
"$ref": "#/definitions/github.com.aquasecurity.trivy.pkg.iac.types.BoolValue"
45304530
},
4531+
"httpsonly": {
4532+
"type": "object",
4533+
"$ref": "#/definitions/github.com.aquasecurity.trivy.pkg.iac.types.BoolValue"
4534+
},
45314535
"identity": {
45324536
"type": "object",
45334537
"$ref": "#/definitions/github.com.aquasecurity.trivy.pkg.iac.providers.azure.appservice.Service.Identity"
45344538
},
45354539
"site": {
45364540
"type": "object",
4537-
"$ref": "#/definitions/github.com.aquasecurity.trivy.pkg.iac.providers.azure.appservice.Service.Site"
4541+
"$ref": "#/definitions/github.com.aquasecurity.trivy.pkg.iac.providers.azure.appservice.Site"
45384542
}
45394543
}
45404544
},
@@ -4556,16 +4560,28 @@
45564560
}
45574561
}
45584562
},
4559-
"github.com.aquasecurity.trivy.pkg.iac.providers.azure.appservice.Service.Site": {
4563+
"github.com.aquasecurity.trivy.pkg.iac.providers.azure.appservice.Site": {
45604564
"type": "object",
45614565
"properties": {
45624566
"enablehttp2": {
45634567
"type": "object",
45644568
"$ref": "#/definitions/github.com.aquasecurity.trivy.pkg.iac.types.BoolValue"
45654569
},
4570+
"ftpsstate": {
4571+
"type": "object",
4572+
"$ref": "#/definitions/github.com.aquasecurity.trivy.pkg.iac.types.StringValue"
4573+
},
45664574
"minimumtlsversion": {
45674575
"type": "object",
45684576
"$ref": "#/definitions/github.com.aquasecurity.trivy.pkg.iac.types.StringValue"
4577+
},
4578+
"phpversion": {
4579+
"type": "object",
4580+
"$ref": "#/definitions/github.com.aquasecurity.trivy.pkg.iac.types.StringValue"
4581+
},
4582+
"pythonversion": {
4583+
"type": "object",
4584+
"$ref": "#/definitions/github.com.aquasecurity.trivy.pkg.iac.types.StringValue"
45694585
}
45704586
}
45714587
},

0 commit comments

Comments
 (0)