From d887f68ffe28bbbaadbc7c592231336b55ad7a22 Mon Sep 17 00:00:00 2001 From: Peter Trifanov Date: Mon, 3 Jul 2023 15:22:34 +0200 Subject: [PATCH] Run `rules-api update` (#779) --- iac-extensions/arm/sonarpedia.json | 2 +- .../rules/azureresourcemanager/S5332.html | 112 ++++++++---------- .../rules/azureresourcemanager/S6413.html | 80 ++++++------- 3 files changed, 81 insertions(+), 113 deletions(-) diff --git a/iac-extensions/arm/sonarpedia.json b/iac-extensions/arm/sonarpedia.json index ea1f5d6d8c..6a624abd9e 100644 --- a/iac-extensions/arm/sonarpedia.json +++ b/iac-extensions/arm/sonarpedia.json @@ -3,7 +3,7 @@ "languages": [ "AZURE_RESOURCE_MANAGER" ], - "latest-update": "2023-05-23T11:57:37.464993800Z", + "latest-update": "2023-07-03T13:06:33.631144Z", "options": { "no-language-in-filenames": true, "preserve-filenames": true diff --git a/iac-extensions/arm/src/main/resources/org/sonar/l10n/azureresourcemanager/rules/azureresourcemanager/S5332.html b/iac-extensions/arm/src/main/resources/org/sonar/l10n/azureresourcemanager/rules/azureresourcemanager/S5332.html index fe74f977e4..bbb3a4bad5 100644 --- a/iac-extensions/arm/src/main/resources/org/sonar/l10n/azureresourcemanager/rules/azureresourcemanager/S5332.html +++ b/iac-extensions/arm/src/main/resources/org/sonar/l10n/azureresourcemanager/rules/azureresourcemanager/S5332.html @@ -1,58 +1,51 @@ -

Clear-text protocols such as ftp, telnet, or http lack encryption of transported data, as well as - the - capability to build an authenticated connection. It means that an attacker able to sniff traffic from the network can read, modify, or - corrupt the - transported content. These protocols are not secure as they expose applications to an extensive range of risks:

+

Clear-text protocols such as ftp, telnet, or http lack encryption of transported data, as well as the +capability to build an authenticated connection. It means that an attacker able to sniff traffic from the network can read, modify, or corrupt the +transported content. These protocols are not secure as they expose applications to an extensive range of risks:

-

Even in the context of isolated networks like offline environments or segmented cloud environments, the insider threat exists. Thus, - attacks - involving communications being sniffed or tampered with can still happen.

+

Even in the context of isolated networks like offline environments or segmented cloud environments, the insider threat exists. Thus, attacks +involving communications being sniffed or tampered with can still happen.

For example, attackers could successfully compromise prior security layers by:

-

In such cases, encrypting communications would decrease the chances of attackers to successfully leak data or steal credentials from - other network - components. By layering various security practices (segmentation and encryption, for example), the application will follow the - defense-in-depth principle.

+

In such cases, encrypting communications would decrease the chances of attackers to successfully leak data or steal credentials from other network +components. By layering various security practices (segmentation and encryption, for example), the application will follow the +defense-in-depth principle.

Note that using the http protocol is being deprecated by major web browsers.

+href="https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http">major web browsers.

In the past, it has led to the following vulnerabilities:

Ask Yourself Whether

There is a risk if you answered yes to any of those questions.

Recommended Secure Coding Practices

-

It is recommended to secure all transport channels, even on local networks, as it can take a single non-secure connection to compromise - an entire - application or system.

+

It is recommended to secure all transport channels, even on local networks, as it can take a single non-secure connection to compromise an entire +application or system.

Sensitive Code Example

For Microsoft.Web/sites:

@@ -86,8 +79,7 @@ 
Sensitive Code Example

   ]
 }
-

For Microsoft.Storage/storageAccounts: -

+

For Microsoft.Storage/storageAccounts:

 {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -103,9 +95,7 @@ 
Sensitive Code Example

   ]
 }
-

For Microsoft.ApiManagement/service/apis: -

+

For Microsoft.ApiManagement/service/apis:

 {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -121,8 +111,7 @@ 
Sensitive Code Example

   ]
 }
-

For Microsoft.Cdn/profiles/endpoints: -

+

For Microsoft.Cdn/profiles/endpoints:

 {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -139,8 +128,7 @@ 
Sensitive Code Example

 }

For Microsoft.Cache/redisEnterprise/databases: -

+href="https://learn.microsoft.com/en-us/azure/templates/microsoft.cache/redisenterprise/databases">Microsoft.Cache/redisEnterprise/databases:

 {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -157,8 +145,8 @@ 
Sensitive Code Example

 }

For Microsoft.DBforMySQL/servers, Microsoft.DBforMariaDB/servers, and Microsoft.DBforPostgreSQL/servers:

+href="https://learn.microsoft.com/en-us/azure/templates/microsoft.dbformariadb/servers">Microsoft.DBforMariaDB/servers, and Microsoft.DBforPostgreSQL/servers:

 {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -207,8 +195,7 @@ 
Compliant Solution

   ]
 }
-

For Microsoft.Storage/storageAccounts: -

+

For Microsoft.Storage/storageAccounts:

 {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -224,9 +211,7 @@ 
Compliant Solution

   ]
 }
-

For Microsoft.ApiManagement/service/apis: -

+

For Microsoft.ApiManagement/service/apis:

 {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -242,8 +227,7 @@ 
Compliant Solution

   ]
 }
-

For Microsoft.Cdn/profiles/endpoints: -

+

For Microsoft.Cdn/profiles/endpoints:

 {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -260,8 +244,7 @@ 
Compliant Solution

 }

For Microsoft.Cache/redisEnterprise/databases: -

+href="https://learn.microsoft.com/en-us/azure/templates/microsoft.cache/redisenterprise/databases">Microsoft.Cache/redisEnterprise/databases:

 {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -278,8 +261,8 @@ 
Compliant Solution

 }

For Microsoft.DBforMySQL/servers, Microsoft.DBforMariaDB/servers, and Microsoft.DBforPostgreSQL/servers:

+href="https://learn.microsoft.com/en-us/azure/templates/microsoft.dbformariadb/servers">Microsoft.DBforMariaDB/servers, and Microsoft.DBforPostgreSQL/servers:

 {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -297,10 +280,9 @@ 
Compliant Solution

See

diff --git a/iac-extensions/arm/src/main/resources/org/sonar/l10n/azureresourcemanager/rules/azureresourcemanager/S6413.html b/iac-extensions/arm/src/main/resources/org/sonar/l10n/azureresourcemanager/rules/azureresourcemanager/S6413.html index 07bc1599a5..d6f42a1631 100644 --- a/iac-extensions/arm/src/main/resources/org/sonar/l10n/azureresourcemanager/rules/azureresourcemanager/S6413.html +++ b/iac-extensions/arm/src/main/resources/org/sonar/l10n/azureresourcemanager/rules/azureresourcemanager/S6413.html @@ -1,18 +1,14 @@ -

Defining a short log retention duration can reduce an organization’s ability to backtrace the actions of malicious actors in case of a - security - incident.

-

Logging allows operational and security teams to get detailed and real-time feedback on an information system’s events. The logging - coverage - enables them to quickly react to events, ranging from the most benign bugs to the most impactful security incidents, such as - intrusions.

-

Apart from security detection, logging capabilities also directly influence future digital forensic analyses. For example, detailed - logging will - allow investigators to establish a timeline of the actions perpetrated by an attacker.

+

Defining a short log retention duration can reduce an organization’s ability to backtrace the actions of malicious actors in case of a security +incident.

+

Logging allows operational and security teams to get detailed and real-time feedback on an information system’s events. The logging coverage +enables them to quickly react to events, ranging from the most benign bugs to the most impactful security incidents, such as intrusions.

+

Apart from security detection, logging capabilities also directly influence future digital forensic analyses. For example, detailed logging will +allow investigators to establish a timeline of the actions perpetrated by an attacker.

Ask Yourself Whether

There is a risk if you answered yes to any of those questions.

Recommended Secure Coding Practices

@@ -37,12 +33,10 @@

Sensitive Code Example

] } -

Raise issue when retentionDays is smaller than 14, but not 0 (zero), or if isEnabled - is - false or the insights block is missing.

-

For Microsoft Network Network - Watchers Flow - Logs:

+

Raise issue when retentionDays is smaller than 14, but not 0 (zero), or if isEnabled is +false or the insights block is missing.

+

For Microsoft Network Network Watchers Flow +Logs:

 {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -62,10 +56,9 @@ 
Sensitive Code Example

 }

Raise issue when days is smaller than 14, but not 0 (zero), or if enabled is set to - false or retentionPolicy is missing.

-

For Microsoft SQL Servers - Auditing - Settings:

+false or retentionPolicy is missing.

+

For Microsoft SQL Servers Auditing +Settings:

 {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -84,24 +77,19 @@ 
Sensitive Code Example

 
Raise issue when retentionDays is smaller than 14, but not 0 (zero).

 
The same case applies to other types (when type field is set to one of following):

 
 
Compliant Solution

 
For Azure Firewall Policy:

@@ -123,9 +111,8 @@ 
Compliant Solution

   ]
 }
-

For Microsoft Network Network - Watchers Flow - Logs:

+

For Microsoft Network Network Watchers Flow +Logs:

 {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -144,9 +131,8 @@ 
Compliant Solution

   ]
 }
-

For Microsoft SQL Servers - Auditing - Settings:

+

For Microsoft SQL Servers Auditing +Settings:

 {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",