Skip to content

Commit e3f59eb

Browse files
committed
feat: Add docs
1 parent c3e4525 commit e3f59eb

File tree

1 file changed

+116
-2
lines changed

1 file changed

+116
-2
lines changed

ql/lib/codeql/bicep/frameworks/Microsoft/Storage.qll

Lines changed: 116 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ module Storage {
3939

4040
/**
4141
* Represents a resource of type Microsoft.Compute/disks in Bicep.
42-
* Provides access to disk pools and disk properties.
42+
* Provides access to disk properties, encryption, zones, and disk pools.
4343
* See: https://learn.microsoft.com/en-us/azure/templates/microsoft.compute/disks
4444
*/
4545
class Disks extends Resource {
@@ -48,12 +48,21 @@ module Storage {
4848
*/
4949
Disks() { this.getResourceType().regexpMatch("^Microsoft.Compute/disks@.*") }
5050

51+
/**
52+
* Gets the properties object for the disk.
53+
*/
5154
DisksProperties::Properties getProperties() { result = this.getProperty("properties") }
5255

56+
/**
57+
* Gets the zones for the disk as an array of strings.
58+
*/
5359
StringLiteral getZones() {
5460
result = this.getProperty("zones").(Array).getElements()
5561
}
56-
62+
63+
/**
64+
* Gets the encryption settings for the disk.
65+
*/
5766
DisksProperties::EncryptionSettings getEncryptionSettings() {
5867
result = this.getProperties().getEncryptionSettings()
5968
}
@@ -66,15 +75,24 @@ module Storage {
6675
override string toString() { result = "Disks" }
6776
}
6877

78+
/**
79+
* Represents a public disk resource where blob public access is enabled.
80+
*/
6981
private class PublicDisks extends PublicResource {
7082
private StorageAccounts accounts;
7183

84+
/**
85+
* Constructs a PublicDisks resource if blob public access is enabled.
86+
*/
7287
PublicDisks() {
7388
accounts.getProperties().allowBlobPublicAccess() = true
7489
and
7590
this = accounts
7691
}
7792

93+
/**
94+
* Gets the property indicating public access for the disk.
95+
*/
7896
override Expr getPublicAccessProperty() {
7997
result = accounts.getProperties().getAllowBlobPublicAccess()
8098
}
@@ -151,28 +169,61 @@ module Storage {
151169
class Properties extends ResourceProperties {
152170
private StorageAccounts storageAccounts;
153171

172+
/**
173+
* Constructs a Properties object for storage accounts.
174+
*/
154175
Properties() { this = storageAccounts.getProperty("properties") }
155176

177+
/**
178+
* Gets the minimum TLS version for the storage account.
179+
*/
156180
StringLiteral getMinimumTlsVersion() { result = this.getProperty("minimumTlsVersion") }
157181

182+
/**
183+
* Gets the minimum TLS version as a string.
184+
*/
158185
string minimumTlsVersion() { result = this.getMinimumTlsVersion().getValue() }
159186

187+
/**
188+
* Gets the property indicating whether blob public access is allowed.
189+
*/
160190
Boolean getAllowBlobPublicAccess() { result = this.getProperty("allowBlobPublicAccess") }
161191

192+
/**
193+
* Gets whether blob public access is allowed as a boolean.
194+
*/
162195
boolean allowBlobPublicAccess() { result = this.getAllowBlobPublicAccess().getBool() }
163196

197+
/**
198+
* Gets the property indicating whether HTTPS traffic is supported only.
199+
*/
164200
Boolean getSupportsHttpsTrafficOnly() {
165201
result = this.getProperty("supportsHttpsTrafficOnly")
166202
}
167203

204+
/**
205+
* Gets the network ACLs for the storage account.
206+
*/
168207
Network::NetworkAcl getNetworkAcls() { result = this.getProperty("networkAcls") }
169208

209+
/**
210+
* Gets the access tier for the storage account.
211+
*/
170212
StringLiteral getAccessTier() { result = this.getProperty("accessTier") }
171213

214+
/**
215+
* Gets the access tier as a string.
216+
*/
172217
string accessTier() { result = this.getAccessTier().getValue() }
173218

219+
/**
220+
* Gets the property indicating whether hierarchical namespace is enabled.
221+
*/
174222
Boolean getIsHnsEnabled() { result = this.getProperty("isHnsEnabled") }
175223

224+
/**
225+
* Gets whether hierarchical namespace is enabled as a boolean.
226+
*/
176227
boolean isHnsEnabled() { result = this.getIsHnsEnabled().getBool() }
177228

178229
/**
@@ -181,6 +232,9 @@ module Storage {
181232
*/
182233
boolean supportsHttpsTrafficOnly() { result = this.getSupportsHttpsTrafficOnly().getBool() }
183234

235+
/**
236+
* Converts the properties object to a string representation.
237+
*/
184238
string toString() { result = "StorageAccountsProperties" }
185239
}
186240
}
@@ -193,34 +247,67 @@ module Storage {
193247
class Properties extends ResourceProperties {
194248
private Disks disks;
195249

250+
/**
251+
* Constructs a Properties object for disks.
252+
*/
196253
Properties() { this = disks.getProperty("properties") }
197254

255+
/**
256+
* Gets the encryption settings for the disk.
257+
*/
198258
EncryptionSettings getEncryptionSettings() {
199259
result = this.getProperty("encryption")
200260
}
201261

262+
/**
263+
* Gets whether encryption is enabled for the disk.
264+
*/
202265
boolean getEncryptionEnabled() {
203266
result = this.getEncryptionSettings().getProperty("enabled").(Boolean).getBool()
204267
}
205268

269+
/**
270+
* Gets the size of the disk in GB.
271+
*/
206272
Number getDiskSizeGB() { result = this.getProperty("diskSizeGB") }
207273

274+
/**
275+
* Converts the properties object to a string representation.
276+
*/
208277
string toString() { result = "DiskProperties" }
209278
}
210279

280+
/**
281+
* Represents the encryption settings object for disks in Bicep.
282+
*/
211283
class EncryptionSettings extends Object {
212284
private Object encryptionSettings;
213285

286+
/**
287+
* Constructs an EncryptionSettings object for disks.
288+
*/
214289
EncryptionSettings() { this = encryptionSettings.getProperty("encryption") }
215290

291+
/**
292+
* Gets the type of encryption used for the disk.
293+
*/
216294
StringLiteral getType() { result = this.getProperty("type") }
217295

296+
/**
297+
* Gets whether encryption is enabled for the disk.
298+
*/
218299
boolean isEncryptionEnabled() { result = this.getProperty("enabled").(Boolean).getBool() }
219300

301+
/**
302+
* Gets the URI of the key vault key used for encryption.
303+
*/
220304
string getKeyVaultKeyUri() {
221305
result = this.getProperty("keyVaultKeyUri").(StringLiteral).getValue()
222306
}
223307

308+
/**
309+
* Converts the encryption settings object to a string representation.
310+
*/
224311
string toString() { result = "DiskEncryptionSettings" }
225312
}
226313
}
@@ -233,24 +320,51 @@ module Storage {
233320
class Properties extends ResourceProperties {
234321
private DiskPools diskPools;
235322

323+
/**
324+
* Constructs a Properties object for disk pools.
325+
*/
236326
Properties() { this = diskPools.getProperty("properties") }
237327

328+
/**
329+
* Gets the provisioning state of the disk pool.
330+
*/
238331
StringLiteral getProvisioningState() { result = this.getProperty("provisioningState") }
239332

333+
/**
334+
* Gets the references to disks attached to the disk pool.
335+
*/
240336
DiskRef getDisksRef() { result = this.getProperty("disks").(Array).getElements() }
241337

338+
/**
339+
* Converts the properties object to a string representation.
340+
*/
242341
string toString() { result = "DiskPoolProperties" }
243342
}
244343

344+
/**
345+
* Represents a reference to a disk in a disk pool.
346+
*/
245347
class DiskRef extends Object {
246348
private Properties properties;
247349

350+
/**
351+
* Constructs a DiskRef object for a disk in a disk pool.
352+
*/
248353
DiskRef() { this = properties.getProperty("disks").(Array).getElements() }
249354

355+
/**
356+
* Gets the ID of the disk reference.
357+
*/
250358
MemberExpression getId() { result = this.getProperty("id") }
251359

360+
/**
361+
* Gets the ID of the disk reference as a string.
362+
*/
252363
string id() { result = this.getId().getNamespace().getName() }
253364

365+
/**
366+
* Converts the disk reference object to a string representation.
367+
*/
254368
string toString() { result = "DiskRef" }
255369
}
256370
}

0 commit comments

Comments
 (0)