Skip to content

Commit baa44fa

Browse files
GeekMasherGeekMasher
committed
feat(tests): Add tests for Database queries
1 parent 48760b9 commit baa44fa

File tree

18 files changed

+498
-0
lines changed

18 files changed

+498
-0
lines changed

‎ql/test/queries-tests/security/CWE-284/DatabasePublicNetworkAccess/DatabasePublicNetworkAccess.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
| app.bicep:8:26:8:34 | String | Database 'vulnerable-sql-server' has public network access enabled, making it accessible from the internet. |
2+
| app.bicep:19:26:19:34 | String | Database 'vulnerable-postgresql' has public network access enabled, making it accessible from the internet. |
3+
| app.bicep:31:26:31:34 | String | Database 'vulnerable-mysql' has public network access enabled, making it accessible from the internet. |

‎ql/test/queries-tests/security/CWE-284/DatabasePublicNetworkAccess/DatabasePublicNetworkAccess.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-284/DatabasePublicNetworkAccess.ql

‎ql/test/queries-tests/security/CWE-284/DatabasePublicNetworkAccess/app.bicep

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
// Test cases for database public network access detection
2+
3+
// TEST CASE: Vulnerable - SQL Server with public network access enabled
4+
resource vulnerableSqlServer 'Microsoft.Sql/servers@2021-11-01' = {
5+
name: 'vulnerable-sql-server'
6+
location: 'eastus'
7+
properties: {
8+
publicNetworkAccess: 'Enabled' // Should be detected
9+
administratorLogin: 'sqladmin'
10+
administratorLoginPassword: 'Password123!'
11+
}
12+
}
13+
14+
// TEST CASE: Vulnerable - PostgreSQL with public network access enabled
15+
resource vulnerablePostgreSQL 'Microsoft.DBforPostgreSQL/servers@2017-12-01' = {
16+
name: 'vulnerable-postgresql'
17+
location: 'eastus'
18+
properties: {
19+
publicNetworkAccess: 'Enabled' // Should be detected
20+
administratorLogin: 'pgadmin'
21+
administratorLoginPassword: 'Password123!'
22+
sslEnforcement: 'Enabled'
23+
}
24+
}
25+
26+
// TEST CASE: Vulnerable - MySQL with public network access enabled
27+
resource vulnerableMySQL 'Microsoft.DBforMySQL/servers@2017-12-01' = {
28+
name: 'vulnerable-mysql'
29+
location: 'eastus'
30+
properties: {
31+
publicNetworkAccess: 'Enabled' // Should be detected
32+
administratorLogin: 'mysqladmin'
33+
administratorLoginPassword: 'Password123!'
34+
sslEnforcement: 'Enabled'
35+
}
36+
}
37+
38+
// TEST CASE: Secure - SQL Server with public network access disabled
39+
resource secureSqlServer 'Microsoft.Sql/servers@2021-11-01' = {
40+
name: 'secure-sql-server'
41+
location: 'eastus'
42+
properties: {
43+
publicNetworkAccess: 'Disabled' // Should NOT be detected
44+
administratorLogin: 'sqladmin'
45+
administratorLoginPassword: 'Password123!'
46+
}
47+
}
48+
49+
// TEST CASE: Secure - PostgreSQL with public network access disabled
50+
resource securePostgreSQL 'Microsoft.DBforPostgreSQL/servers@2017-12-01' = {
51+
name: 'secure-postgresql'
52+
location: 'eastus'
53+
properties: {
54+
publicNetworkAccess: 'Disabled' // Should NOT be detected
55+
administratorLogin: 'pgadmin'
56+
administratorLoginPassword: 'Password123!'
57+
sslEnforcement: 'Enabled'
58+
}
59+
}
60+
61+
// TEST CASE: Secure - MySQL without explicit public network access (defaults to disabled)
62+
resource defaultMySQL 'Microsoft.DBforMySQL/servers@2017-12-01' = {
63+
name: 'default-mysql'
64+
location: 'eastus'
65+
properties: {
66+
// publicNetworkAccess not specified - should NOT be detected
67+
administratorLogin: 'mysqladmin'
68+
administratorLoginPassword: 'Password123!'
69+
sslEnforcement: 'Enabled'
70+
}
71+
}

‎ql/test/queries-tests/security/CWE-311/DatabaseNoInfrastructureEncryption/DatabaseNoInfrastructureEncryption.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
| app.bicep:4:1:14:1 | DatabaseResource[postgresql] | Database 'vulnerable-postgresql-no-encryption' does not have infrastructure encryption enabled, which may expose data at the infrastructure level. |
2+
| app.bicep:17:1:27:1 | DatabaseResource[mysql] | Database 'vulnerable-mysql-disabled-encryption' does not have infrastructure encryption enabled, which may expose data at the infrastructure level. |
3+
| app.bicep:30:1:40:1 | DatabaseResource[mariadb] | Database 'vulnerable-mariadb-no-encryption' does not have infrastructure encryption enabled, which may expose data at the infrastructure level. |

‎ql/test/queries-tests/security/CWE-311/DatabaseNoInfrastructureEncryption/DatabaseNoInfrastructureEncryption.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-311/DatabaseNoInfrastructureEncryption.ql

‎ql/test/queries-tests/security/CWE-311/DatabaseNoInfrastructureEncryption/app.bicep

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
// Test cases for database infrastructure encryption detection
2+
3+
// TEST CASE: Vulnerable - PostgreSQL without infrastructure encryption (missing property)
4+
resource vulnerablePostgreSQL_NoEncryption 'Microsoft.DBforPostgreSQL/servers@2017-12-01' = {
5+
name: 'vulnerable-postgresql-no-encryption'
6+
location: 'eastus'
7+
properties: {
8+
// infrastructureEncryption not specified - should be detected
9+
administratorLogin: 'pgadmin'
10+
administratorLoginPassword: 'Password123!'
11+
sslEnforcement: 'Enabled'
12+
minimalTlsVersion: '1.2'
13+
}
14+
}
15+
16+
// TEST CASE: Vulnerable - MySQL with infrastructure encryption explicitly disabled
17+
resource vulnerableMySQL_DisabledEncryption 'Microsoft.DBforMySQL/servers@2017-12-01' = {
18+
name: 'vulnerable-mysql-disabled-encryption'
19+
location: 'eastus'
20+
properties: {
21+
infrastructureEncryption: 'Disabled' // Should be detected
22+
administratorLogin: 'mysqladmin'
23+
administratorLoginPassword: 'Password123!'
24+
sslEnforcement: 'Enabled'
25+
minimalTlsVersion: '1.2'
26+
}
27+
}
28+
29+
// TEST CASE: Vulnerable - MariaDB without infrastructure encryption
30+
resource vulnerableMariaDB_NoEncryption 'Microsoft.DBforMariaDB/servers@2018-06-01' = {
31+
name: 'vulnerable-mariadb-no-encryption'
32+
location: 'eastus'
33+
properties: {
34+
// infrastructureEncryption not specified - should be detected
35+
administratorLogin: 'mariaadmin'
36+
administratorLoginPassword: 'Password123!'
37+
sslEnforcement: 'Enabled'
38+
minimalTlsVersion: '1.2'
39+
}
40+
}
41+
42+
// TEST CASE: Secure - PostgreSQL with infrastructure encryption enabled
43+
resource securePostgreSQL_WithEncryption 'Microsoft.DBforPostgreSQL/servers@2017-12-01' = {
44+
name: 'secure-postgresql-with-encryption'
45+
location: 'eastus'
46+
properties: {
47+
infrastructureEncryption: 'Enabled' // Should NOT be detected
48+
administratorLogin: 'pgadmin'
49+
administratorLoginPassword: 'Password123!'
50+
sslEnforcement: 'Enabled'
51+
minimalTlsVersion: '1.2'
52+
}
53+
}
54+
55+
// TEST CASE: Secure - MySQL with infrastructure encryption enabled
56+
resource secureMySQL_WithEncryption 'Microsoft.DBforMySQL/servers@2017-12-01' = {
57+
name: 'secure-mysql-with-encryption'
58+
location: 'eastus'
59+
properties: {
60+
infrastructureEncryption: 'Enabled' // Should NOT be detected
61+
administratorLogin: 'mysqladmin'
62+
administratorLoginPassword: 'Password123!'
63+
sslEnforcement: 'Enabled'
64+
minimalTlsVersion: '1.2'
65+
}
66+
}
67+
68+
// TEST CASE: Note - SQL Server and CosmosDB typically don't have infrastructureEncryption property
69+
// so they should not be detected by this query

‎ql/test/queries-tests/security/CWE-319/DatabaseSslNotEnforced/DatabaseSslNotEnforced.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
| app.bicep:8:21:8:30 | String | Database 'vulnerable-postgresql-no-ssl' has SSL enforcement disabled, allowing unencrypted connections that may expose data in transit. |
2+
| app.bicep:19:21:19:30 | String | Database 'vulnerable-mysql-no-ssl' has SSL enforcement disabled, allowing unencrypted connections that may expose data in transit. |
3+
| app.bicep:30:21:30:30 | String | Database 'vulnerable-mariadb-no-ssl' has SSL enforcement disabled, allowing unencrypted connections that may expose data in transit. |

‎ql/test/queries-tests/security/CWE-319/DatabaseSslNotEnforced/DatabaseSslNotEnforced.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-319/DatabaseSslNotEnforced.ql

‎ql/test/queries-tests/security/CWE-319/DatabaseSslNotEnforced/app.bicep

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
// Test cases for database SSL enforcement detection
2+
3+
// TEST CASE: Vulnerable - PostgreSQL with SSL enforcement disabled
4+
resource vulnerablePostgreSQL_NoSSL 'Microsoft.DBforPostgreSQL/servers@2017-12-01' = {
5+
name: 'vulnerable-postgresql-no-ssl'
6+
location: 'eastus'
7+
properties: {
8+
sslEnforcement: 'Disabled' // Should be detected
9+
administratorLogin: 'pgadmin'
10+
administratorLoginPassword: 'Password123!'
11+
}
12+
}
13+
14+
// TEST CASE: Vulnerable - MySQL with SSL enforcement disabled
15+
resource vulnerableMySQL_NoSSL 'Microsoft.DBforMySQL/servers@2017-12-01' = {
16+
name: 'vulnerable-mysql-no-ssl'
17+
location: 'eastus'
18+
properties: {
19+
sslEnforcement: 'Disabled' // Should be detected
20+
administratorLogin: 'mysqladmin'
21+
administratorLoginPassword: 'Password123!'
22+
}
23+
}
24+
25+
// TEST CASE: Vulnerable - MariaDB with SSL enforcement disabled
26+
resource vulnerableMariaDB_NoSSL 'Microsoft.DBforMariaDB/servers@2018-06-01' = {
27+
name: 'vulnerable-mariadb-no-ssl'
28+
location: 'eastus'
29+
properties: {
30+
sslEnforcement: 'Disabled' // Should be detected
31+
administratorLogin: 'mariaadmin'
32+
administratorLoginPassword: 'Password123!'
33+
}
34+
}
35+
36+
// TEST CASE: Secure - PostgreSQL with SSL enforcement enabled
37+
resource securePostgreSQL_WithSSL 'Microsoft.DBforPostgreSQL/servers@2017-12-01' = {
38+
name: 'secure-postgresql-with-ssl'
39+
location: 'eastus'
40+
properties: {
41+
sslEnforcement: 'Enabled' // Should NOT be detected
42+
minimalTlsVersion: '1.2'
43+
administratorLogin: 'pgadmin'
44+
administratorLoginPassword: 'Password123!'
45+
}
46+
}
47+
48+
// TEST CASE: Secure - MySQL with SSL enforcement enabled
49+
resource secureMySQL_WithSSL 'Microsoft.DBforMySQL/servers@2017-12-01' = {
50+
name: 'secure-mysql-with-ssl'
51+
location: 'eastus'
52+
properties: {
53+
sslEnforcement: 'Enabled' // Should NOT be detected
54+
minimalTlsVersion: 'TLS1_2'
55+
administratorLogin: 'mysqladmin'
56+
administratorLoginPassword: 'Password123!'
57+
}
58+
}
59+
60+
// TEST CASE: Secure - Database without explicit SSL enforcement (uses defaults)
61+
resource defaultSSLDatabase 'Microsoft.DBforPostgreSQL/servers@2017-12-01' = {
62+
name: 'default-ssl-database'
63+
location: 'eastus'
64+
properties: {
65+
// sslEnforcement not specified - should NOT be detected (depends on default)
66+
administratorLogin: 'pgadmin'
67+
administratorLoginPassword: 'Password123!'
68+
}
69+
}
70+
71+
// TEST CASE: Note - SQL Server typically doesn't have sslEnforcement property
72+
// CosmosDB also doesn't have this property, so they won't be detected

‎ql/test/queries-tests/security/CWE-327/DatabaseWeakTlsVersion/DatabaseWeakTlsVersion.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
| app.bicep:8:24:8:28 | String | Database 'vulnerable-postgresql-tls10' is configured with weak TLS version '1.0'. Use TLS 1.2 or higher. |
2+
| app.bicep:20:24:20:31 | String | Database 'vulnerable-mysql-tls11' is configured with weak TLS version 'TLS1_1'. Use TLS 1.2 or higher. |
3+
| app.bicep:32:24:32:28 | String | Database 'vulnerable-sql-tls10' is configured with weak TLS version '1.0'. Use TLS 1.2 or higher. |
4+
| app.bicep:43:24:43:32 | String | Database 'vulnerable-mariadb-tls11' is configured with weak TLS version 'TLS_1.1'. Use TLS 1.2 or higher. |

0 commit comments

Comments
 (0)