Skip to content

Commit 261ec15

Browse files
GeekMasherGeekMasher
committed
feat(tests): Add test cases for Azure Web App security configurations including Always On, public network access, client certificate requirements, and HTTPS-only settings
1 parent d7afd09 commit 261ec15

File tree

12 files changed

+337
-0
lines changed

12 files changed

+337
-0
lines changed

‎ql/test/queries-tests/reliability/WebAppAlwaysOnDisabled/WebAppAlwaysOnDisabled.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| webapp-without-alwayson | Azure Web App doesn't have Always On enabled, which can lead to poor reliability and potential security issues due to cold starts. |
2+
| webapp-with-alwayson-disabled | Azure Web App doesn't have Always On enabled, which can lead to poor reliability and potential security issues due to cold starts. |

‎ql/test/queries-tests/reliability/WebAppAlwaysOnDisabled/WebAppAlwaysOnDisabled.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/reliability/WebAppAlwaysOnDisabled.ql

‎ql/test/queries-tests/reliability/WebAppAlwaysOnDisabled/app.bicep

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
// This is a test file for the WebAppAlwaysOnDisabled query
2+
// It contains examples of secure and insecure configurations
3+
4+
param location string = resourceGroup().location
5+
6+
// App Service Plan
7+
resource appServicePlan 'Microsoft.Web/serverfarms@2022-03-01' = {
8+
name: 'app-plan-test'
9+
location: location
10+
sku: {
11+
name: 'S1'
12+
tier: 'Standard'
13+
}
14+
}
15+
16+
// Insecure: Web App without Always On enabled (Default)
17+
resource webAppWithoutAlwaysOn 'Microsoft.Web/sites@2022-03-01' = {
18+
name: 'webapp-without-alwayson'
19+
location: location
20+
kind: 'app' // Specifies it's a regular web app
21+
properties: {
22+
serverFarmId: appServicePlan.id
23+
siteConfig: {
24+
// Always On is not explicitly set, defaults to false
25+
}
26+
}
27+
}
28+
29+
// Insecure: Web App with Always On explicitly disabled
30+
resource webAppWithAlwaysOnDisabled 'Microsoft.Web/sites@2022-03-01' = {
31+
name: 'webapp-with-alwayson-disabled'
32+
location: location
33+
kind: 'app' // Specifies it's a regular web app
34+
properties: {
35+
serverFarmId: appServicePlan.id
36+
siteConfig: {
37+
alwaysOn: false // Explicitly disabled
38+
}
39+
}
40+
}
41+
42+
// Secure: Web App with Always On enabled
43+
resource webAppWithAlwaysOn 'Microsoft.Web/sites@2022-03-01' = {
44+
name: 'webapp-with-alwayson'
45+
location: location
46+
kind: 'app' // Specifies it's a regular web app
47+
properties: {
48+
serverFarmId: appServicePlan.id
49+
siteConfig: {
50+
alwaysOn: true // Explicitly enabled
51+
}
52+
}
53+
}
54+
55+
// Function App without Always On (should not be flagged)
56+
resource functionApp 'Microsoft.Web/sites@2022-03-01' = {
57+
name: 'function-app-without-alwayson'
58+
location: location
59+
kind: 'functionapp' // Specifies it's a function app
60+
properties: {
61+
serverFarmId: appServicePlan.id
62+
siteConfig: {
63+
// Always On not set for function app is acceptable
64+
}
65+
}
66+
}

‎ql/test/queries-tests/security/CWE-284/WebAppPublicNetworkAccess/WebAppPublicNetworkAccess.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| app.bicep:46:1:54:1 | AppService[insecureWebApp] | Azure Web App has unrestricted public network access without VNet integration, potentially increasing attack surface. |
2+
| app.bicep:57:1:65:1 | AppService[explicitlyInsecureWebApp] | Azure Web App has unrestricted public network access without VNet integration, potentially increasing attack surface. |

‎ql/test/queries-tests/security/CWE-284/WebAppPublicNetworkAccess/WebAppPublicNetworkAccess.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-284/WebAppPublicNetworkAccess.ql

‎ql/test/queries-tests/security/CWE-284/WebAppPublicNetworkAccess/app.bicep

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
// This is a test file for the WebAppPublicNetworkAccess query
2+
// It contains examples of secure and insecure configurations
3+
4+
param location string = resourceGroup().location
5+
6+
// App Service Plan
7+
resource appServicePlan 'Microsoft.Web/serverfarms@2022-03-01' = {
8+
name: 'app-plan-test'
9+
location: location
10+
sku: {
11+
name: 'S1'
12+
tier: 'Standard'
13+
}
14+
}
15+
16+
// VNet resource
17+
resource vnet 'Microsoft.Network/virtualNetworks@2021-02-01' = {
18+
name: 'test-vnet'
19+
location: location
20+
properties: {
21+
addressSpace: {
22+
addressPrefixes: [
23+
'10.0.0.0/16'
24+
]
25+
}
26+
subnets: [
27+
{
28+
name: 'app-subnet'
29+
properties: {
30+
addressPrefix: '10.0.1.0/24'
31+
delegations: [
32+
{
33+
name: 'delegation'
34+
properties: {
35+
serviceName: 'Microsoft.Web/serverfarms'
36+
}
37+
}
38+
]
39+
}
40+
}
41+
]
42+
}
43+
}
44+
45+
// Insecure: Web App with default public network access (enabled) and no VNet integration
46+
resource insecureWebApp 'Microsoft.Web/sites@2022-03-01' = {
47+
name: 'insecure-public-webapp'
48+
location: location
49+
properties: {
50+
serverFarmId: appServicePlan.id
51+
// No public network access restrictions
52+
// No VNet integration
53+
}
54+
}
55+
56+
// Insecure: Web App with explicitly enabled public network access and no VNet integration
57+
resource explicitlyInsecureWebApp 'Microsoft.Web/sites@2022-03-01' = {
58+
name: 'explicitly-insecure-webapp'
59+
location: location
60+
properties: {
61+
serverFarmId: appServicePlan.id
62+
publicNetworkAccess: 'Enabled' // Explicitly allowing public access
63+
// No VNet integration
64+
}
65+
}
66+
67+
// Secure: Web App with VNet integration
68+
resource secureWithVNetWebApp 'Microsoft.Web/sites@2022-03-01' = {
69+
name: 'secure-vnet-webapp'
70+
location: location
71+
properties: {
72+
serverFarmId: appServicePlan.id
73+
// Public network access not explicitly disabled, but has VNet integration
74+
virtualNetworkSubnetId: '${vnet.id}/subnets/app-subnet'
75+
}
76+
}
77+
78+
// Secure: Web App with disabled public network access
79+
resource secureNoPublicWebApp 'Microsoft.Web/sites@2022-03-01' = {
80+
name: 'secure-no-public-webapp'
81+
location: location
82+
properties: {
83+
serverFarmId: appServicePlan.id
84+
publicNetworkAccess: 'Disabled' // Explicitly disabling public access
85+
}
86+
}
87+
88+
// Secure: Web App with VNet integration at the properties level
89+
resource secureWithPropsVNetWebApp 'Microsoft.Web/sites@2022-03-01' = {
90+
name: 'secure-props-vnet-webapp'
91+
location: location
92+
properties: {
93+
serverFarmId: appServicePlan.id
94+
virtualNetworkSubnetId: '${vnet.id}/subnets/app-subnet'
95+
}
96+
}

‎ql/test/queries-tests/security/CWE-295/WebAppMissingClientCert/WebAppMissingClientCert.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
| app.bicep:18:1:26:1 | AppService[insecureWebApp] | Azure Web App with HTTPS enabled doesn't require client certificates for mutual TLS authentication. |
2+
| app.bicep:30:1:39:1 | AppService[partiallySecureWebApp] | Azure Web App with HTTPS enabled doesn't require client certificates for mutual TLS authentication. |
3+
| app.bicep:43:1:52:1 | AppService[explicitlyOptionalWebApp] | Azure Web App with HTTPS enabled doesn't require client certificates for mutual TLS authentication. |
4+
| app.bicep:56:1:65:1 | AppService[secureWebApp] | Azure Web App with HTTPS enabled doesn't require client certificates for mutual TLS authentication. |

‎ql/test/queries-tests/security/CWE-295/WebAppMissingClientCert/WebAppMissingClientCert.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-295/WebAppMissingClientCert.ql

‎ql/test/queries-tests/security/CWE-295/WebAppMissingClientCert/app.bicep

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
// This is a test file for the WebAppMissingClientCert query
2+
// It contains examples of secure and insecure configurations
3+
4+
param location string = resourceGroup().location
5+
6+
// App Service Plan
7+
resource appServicePlan 'Microsoft.Web/serverfarms@2022-03-01' = {
8+
name: 'app-plan-test'
9+
location: location
10+
sku: {
11+
name: 'S1'
12+
tier: 'Standard'
13+
}
14+
}
15+
16+
// Insecure: Web App with HTTPS-Only but no client cert configuration
17+
// This should be flagged by the query
18+
resource insecureWebApp 'Microsoft.Web/sites@2022-03-01' = {
19+
name: 'insecure-webapp-no-clientcert'
20+
location: location
21+
properties: {
22+
serverFarmId: appServicePlan.id
23+
httpsOnly: true // HTTPS is enabled but no client cert
24+
// No client cert configuration
25+
}
26+
}
27+
28+
// Insecure: Web App with HTTPS-Only and client cert enabled but not required
29+
// This should be flagged by the query
30+
resource partiallySecureWebApp 'Microsoft.Web/sites@2022-03-01' = {
31+
name: 'partially-secure-webapp'
32+
location: location
33+
properties: {
34+
serverFarmId: appServicePlan.id
35+
clientCertEnabled: true
36+
httpsOnly: true
37+
// clientCertMode not set to Required
38+
}
39+
}
40+
41+
// Insecure: Web App with explicit non-Required client cert mode
42+
// This should be flagged by the query
43+
resource explicitlyOptionalWebApp 'Microsoft.Web/sites@2022-03-01' = {
44+
name: 'explicitly-optional-webapp'
45+
location: location
46+
properties: {
47+
serverFarmId: appServicePlan.id
48+
clientCertEnabled: true
49+
clientCertMode: 'Optional' // Explicitly not required
50+
httpsOnly: true
51+
}
52+
}
53+
54+
// Secure: Web App with HTTPS-Only and required client cert
55+
// This should NOT be flagged by the query
56+
resource secureWebApp 'Microsoft.Web/sites@2022-03-01' = {
57+
name: 'secure-webapp'
58+
location: location
59+
properties: {
60+
serverFarmId: appServicePlan.id
61+
clientCertEnabled: true
62+
clientCertMode: 'Required' // Client cert is required
63+
httpsOnly: true
64+
}
65+
}
66+
67+
// Web App without HTTPS-Only
68+
// This should NOT be flagged by the query (since we only check apps with HTTPS enabled)
69+
resource httpWebApp 'Microsoft.Web/sites@2022-03-01' = {
70+
name: 'http-webapp'
71+
location: location
72+
properties: {
73+
serverFarmId: appServicePlan.id
74+
// No client cert configuration
75+
}
76+
// No httpsOnly setting
77+
}

‎ql/test/queries-tests/security/CWE-319/SitesWithoutHttpsOnly/SitesWithoutHttpsOnly.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| app.bicep:17:1:27:1 | AppService[insecureWebApp] | Azure Web App is not configured with HTTPS-only mode, potentially allowing insecure HTTP connections. |
2+
| app.bicep:30:1:37:1 | AppService[explicitlyInsecureWebApp] | Azure Web App is not configured with HTTPS-only mode, potentially allowing insecure HTTP connections. |

0 commit comments

Comments
 (0)