-
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
* Fix Public vs Private project Baselines and Rules #45 * Add missing rules
- Loading branch information
Showing
12 changed files
with
301 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
27 changes: 27 additions & 0 deletions
27
...ule.Rules.AzureDevOps/en/Azure.DevOps.Pipelines.Settings.StatusBadgesPrivate.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| --- | ||
| category: Microsoft Azure DevOps Pipelines | ||
| severity: Severe | ||
| online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Pipelines.Settings.StatusBadgesPrivate.md | ||
| --- | ||
|
|
||
| # Azure.DevOps.Pipelines.Settings.StatusBadgesPrivate | ||
|
|
||
| ## SYNOPSIS | ||
|
|
||
| Status badges should not be publicly accessible. | ||
|
|
||
| ## DESCRIPTION | ||
|
|
||
| Status badges are publicly accessible by default. This means anyone with the URL can view | ||
| the status of a pipeline. Consider restricting access to status badges to prevent | ||
| unauthorized access. | ||
|
|
||
| Mininum TokenType: `ReadOnly` | ||
|
|
||
| ## RECOMMENDATION | ||
|
|
||
| Consider restricting access to status badges to prevent unauthorized access. | ||
|
|
||
| ## LINKS | ||
|
|
||
| - [Azure DevOps Security best practices](https://learn.microsoft.com/en-us/azure/devops/organizations/security/security-best-practices?view=azure-devops#tasks) |
26 changes: 26 additions & 0 deletions
26
src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Project.Visibility.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| --- | ||
| category: Microsoft Azure DevOps Projects | ||
| severity: Critical | ||
| online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Project.Visibility.md | ||
| --- | ||
|
|
||
| # Azure.DevOps.Project.Visibility | ||
|
|
||
| ## SYNOPSIS | ||
|
|
||
| Projects should not be publicly accessible. | ||
|
|
||
| ## DESCRIPTION | ||
|
|
||
| Projects can be configured to be publicly accessible. This means anyone with the URL can | ||
| view the project. Consider restricting access to projects to prevent unauthorized access. | ||
|
|
||
| Mininum TokenType: `ReadOnly` | ||
|
|
||
| ## RECOMMENDATION | ||
|
|
||
| Consider restricting access to projects to prevent unauthorized access. | ||
|
|
||
| ## LINKS | ||
|
|
||
| - [Azure DevOps Security best practices](https://learn.microsoft.com/en-us/azure/devops/organizations/security/security-best-practices?view=azure-devops#tasks) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
17 changes: 17 additions & 0 deletions
17
src/PSRule.Rules.AzureDevOps/rules/AzureDevOps.Projects.Rule.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| # PSRule rule definitions for Azure DevOps Pipelines definitions | ||
|
|
||
| # Synopsis: Pipelines should use YAML definitions | ||
| Rule 'Azure.DevOps.Project.Visibility' ` | ||
| -Ref 'ADO-PRJ-001' ` | ||
| -Type 'Azure.DevOps.Project' ` | ||
| -Tag @{ release = 'GA'} ` | ||
| -Level Warning { | ||
| # Description "Projects should not be public" | ||
| Reason "The project is public" | ||
| Recommend "Consider making the project private" | ||
| # Links "https://learn.microsoft.com/en-us/azure/devops/organizations/security/security-best-practices?view=azure-devops#definitions" | ||
| AllOf { | ||
| $Assert.HasField($TargetObject, "visibility", $true) | ||
| $Assert.HasFieldValue($TargetObject, "visibility", "private") | ||
| } | ||
| } |
16 changes: 16 additions & 0 deletions
16
src/PSRule.Rules.AzureDevOps/rules/Baseline.PublicProject.Rule.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| apiVersion: github.com/microsoft/PSRule/v1 | ||
| kind: Baseline | ||
| metadata: | ||
| name: Baseline.PublicProject | ||
| spec: | ||
| rule: | ||
| exclude: | ||
| - 'Azure.DevOps.Project.Visibility' | ||
| - 'Azure.DevOps.Pipelines.Settings.StatusBadgesPrivate' | ||
| tag: | ||
| release: GA | ||
| configuration: | ||
| ghasEnabled: true | ||
| ghasBlockPushesEnabled: true | ||
| branchMinimumApproverCount: 1 | ||
| releaseMinimumProductionApproverCount: 1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| BeforeAll { | ||
| # Setup error handling | ||
| $ErrorActionPreference = 'Stop'; | ||
| Set-StrictMode -Version latest; | ||
|
|
||
| if ($Env:SYSTEM_DEBUG -eq 'true') { | ||
| $VerbosePreference = 'Continue'; | ||
| } | ||
|
|
||
| # Setup tests paths | ||
| # $rootPath = $PWD; | ||
| $rootPath = $env:GITHUB_WORKSPACE | ||
| $ourModule = (Join-Path -Path $rootPath -ChildPath '/src/PSRule.Rules.AzureDevOps') | ||
|
|
||
| Import-Module -Name $ourModule -Force | ||
| $here = (Resolve-Path $PSScriptRoot).Path | ||
|
|
||
| # Get tempory test output folder and store path | ||
| $outPath = Get-Item -Path (Join-Path -Path $here -ChildPath 'out') | ||
| $outPath = $outPath.FullName | ||
|
|
||
| # Run rules with default token type | ||
| $ruleResult = Invoke-PSRule -InputPath "$($outPath)/" -Module PSRule.Rules.AzureDevOps -Format Detect -Culture en | ||
|
|
||
| # Run rules with the public baseline | ||
| $ruleResultPublic = Invoke-PSRule -InputPath "$($outPath)/" -Module PSRule.Rules.AzureDevOps -Format Detect -Culture en -Baseline Baseline.PublicProject | ||
|
|
||
| # Get temporary test output folder for tests with the ReadOnly TokenType | ||
| $outPathReadOnly = Get-Item -Path (Join-Path -Path $here -ChildPath 'outReadOnly') | ||
| $outPathReadOnly = $outPathReadOnly.FullName | ||
|
|
||
| # Run rules with ReadOnly token type | ||
| $ruleResultReadOnly = Invoke-PSRule -InputPath "$($outPathReadOnly)/" -Module PSRule.Rules.AzureDevOps -Format Detect -Culture en | ||
|
|
||
| # Get temporary test output folder for tests with the FineGrained TokenType | ||
| $outPathFineGrained = Get-Item -Path (Join-Path -Path $here -ChildPath 'outFineGrained') | ||
| $outPathFineGrained = $outPathFineGrained.FullName | ||
|
|
||
| # Run rules with FineGrained token type | ||
| $ruleResultFineGrained = Invoke-PSRule -InputPath "$($outPathFineGrained)/" -Module PSRule.Rules.AzureDevOps -Format Detect -Culture en | ||
| } | ||
|
|
||
| Describe "Azure.DevOps.Project rules" { | ||
| Context ' Azure.DevOps.Project.Visibility' { | ||
| It " should pass once" { | ||
| $ruleHits = @($ruleResult | Where-Object { $_.RuleName -eq 'Azure.DevOps.Project.Visibility' }) | ||
| $ruleHits[0].Outcome | Should -Be 'Pass'; | ||
| $ruleHits.Count | Should -Be 1; | ||
| } | ||
|
|
||
| It " should pass once for ReadOnly token type" { | ||
| $ruleHits = @($ruleResultReadOnly | Where-Object { $_.RuleName -eq 'Azure.DevOps.Project.Visibility' }) | ||
| $ruleHits[0].Outcome | Should -Be 'Pass'; | ||
| $ruleHits.Count | Should -Be 1; | ||
| } | ||
|
|
||
| It " should pass once for FineGrained token type" { | ||
| $ruleHits = @($ruleResultFineGrained | Where-Object { $_.RuleName -eq 'Azure.DevOps.Project.Visibility' }) | ||
| $ruleHits[0].Outcome | Should -Be 'Pass'; | ||
| $ruleHits.Count | Should -Be 1; | ||
| } | ||
|
|
||
| It " should not be present in the PublicProject baseline" { | ||
| $ruleHits = @($ruleResultPublic | Where-Object { $_.RuleName -eq 'Azure.DevOps.Project.Visibility' }) | ||
| $ruleHits.Count | Should -Be 0; | ||
| } | ||
| } | ||
| } |