Skip to content

Commit 4e47613

Browse files
GeekMasherGeekMasher
committed
feat(tests): Add Grafana query tests
1 parent 27f66f2 commit 4e47613

24 files changed

+549
-0
lines changed

‎ql/test/queries-tests/security/CWE-200/GrafanaExternalSnapshotsEnabled/GrafanaExternalSnapshotsEnabled.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| app.bicep:11:18:13:7 | Snapshots | External snapshots are enabled in Grafana configuration, which could lead to unintended sharing of dashboard data with external services. |

‎ql/test/queries-tests/security/CWE-200/GrafanaExternalSnapshotsEnabled/GrafanaExternalSnapshotsEnabled.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-200/GrafanaExternalSnapshotsEnabled.ql

‎ql/test/queries-tests/security/CWE-200/GrafanaExternalSnapshotsEnabled/app.bicep

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// Test file for GrafanaExternalSnapshotsEnabled.ql
2+
// Contains examples of secure and insecure configurations
3+
4+
// TEST CASE: Insecure - Grafana with external snapshots enabled
5+
// This should be detected by the query
6+
resource insecureGrafanaSnapshots 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
7+
name: 'insecure-grafana-snapshots'
8+
location: 'eastus'
9+
properties: {
10+
grafanaConfigurations: {
11+
snapshots: {
12+
externalEnabled: true // ALERT: External snapshots are enabled
13+
}
14+
}
15+
}
16+
sku: {
17+
name: 'Standard'
18+
}
19+
}
20+
21+
// TEST CASE: Secure - Grafana with external snapshots disabled
22+
// This should NOT be detected by the query
23+
resource secureGrafanaSnapshots 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
24+
name: 'secure-grafana-snapshots'
25+
location: 'eastus'
26+
properties: {
27+
grafanaConfigurations: {
28+
snapshots: {
29+
externalEnabled: false // Secure: External snapshots are disabled
30+
}
31+
}
32+
}
33+
sku: {
34+
name: 'Standard'
35+
}
36+
}
37+
38+
// TEST CASE: Secure - Grafana with default snapshot settings (property omitted)
39+
// This should NOT be detected by the query (assuming default is false)
40+
resource defaultGrafanaSnapshots 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
41+
name: 'default-grafana-snapshots'
42+
location: 'eastus'
43+
properties: {
44+
grafanaConfigurations: {
45+
// snapshots property omitted
46+
}
47+
}
48+
sku: {
49+
name: 'Standard'
50+
}
51+
}

‎ql/test/queries-tests/security/CWE-272/GrafanaExcessiveEditorPermissions/GrafanaExcessiveEditorPermissions.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| app.bicep:11:14:13:7 | Users | Excessive permissions granted to Grafana editors (editorsCanAdmin=true). This allows editors to administrate dashboards, folders and teams they create. |
2+
| app.bicep:62:14:65:7 | Users | Excessive permissions granted to Grafana editors (editorsCanAdmin=true). This allows editors to administrate dashboards, folders and teams they create. |

‎ql/test/queries-tests/security/CWE-272/GrafanaExcessiveEditorPermissions/GrafanaExcessiveEditorPermissions.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-272/GrafanaExcessiveEditorPermissions.ql

‎ql/test/queries-tests/security/CWE-272/GrafanaExcessiveEditorPermissions/app.bicep

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
// Test file for GrafanaExcessiveEditorPermissions.ql
2+
// Contains examples of secure and insecure configurations
3+
4+
// TEST CASE: Insecure - Grafana with excessive editor permissions
5+
// This should be detected by the query
6+
resource insecureGrafanaEditors 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
7+
name: 'insecure-grafana-editors'
8+
location: 'eastus'
9+
properties: {
10+
grafanaConfigurations: {
11+
users: {
12+
editorsCanAdmin: true // ALERT: Excessive permissions for editors
13+
}
14+
}
15+
}
16+
sku: {
17+
name: 'Standard'
18+
}
19+
}
20+
21+
// TEST CASE: Secure - Grafana with proper editor permissions (explicitly set to false)
22+
// This should NOT be detected by the query
23+
resource secureGrafanaEditors 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
24+
name: 'secure-grafana-editors'
25+
location: 'eastus'
26+
properties: {
27+
grafanaConfigurations: {
28+
users: {
29+
editorsCanAdmin: false // Secure: Editors cannot administrate
30+
}
31+
}
32+
}
33+
sku: {
34+
name: 'Standard'
35+
}
36+
}
37+
38+
// TEST CASE: Secure - Grafana with default editor permissions (property omitted)
39+
// This should NOT be detected by the query (assuming default is false)
40+
resource defaultGrafanaEditors 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
41+
name: 'default-grafana-editors'
42+
location: 'eastus'
43+
properties: {
44+
grafanaConfigurations: {
45+
users: {
46+
// editorsCanAdmin property is omitted, should default to false
47+
}
48+
}
49+
}
50+
sku: {
51+
name: 'Standard'
52+
}
53+
}
54+
55+
// TEST CASE: Complex - Grafana with both viewer and editor permission settings
56+
// The editorsCanAdmin=true should be detected by the query
57+
resource complexGrafana 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
58+
name: 'complex-grafana-permissions'
59+
location: 'eastus'
60+
properties: {
61+
grafanaConfigurations: {
62+
users: {
63+
editorsCanAdmin: true // ALERT: Excessive permissions for editors
64+
viewersCanEdit: false // This is secure, but the resource should still be flagged
65+
}
66+
}
67+
}
68+
sku: {
69+
name: 'Standard'
70+
}
71+
}

‎ql/test/queries-tests/security/CWE-272/GrafanaExcessiveViewerPermissions/GrafanaExcessiveViewerPermissions.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| app.bicep:11:14:13:7 | Users | Excessive permissions granted to Grafana viewers (viewersCanEdit=true). This allows viewers to make temporary edits to dashboards they have access to. |

‎ql/test/queries-tests/security/CWE-272/GrafanaExcessiveViewerPermissions/GrafanaExcessiveViewerPermissions.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-272/GrafanaExcessiveViewerPermissions.ql

‎ql/test/queries-tests/security/CWE-272/GrafanaExcessiveViewerPermissions/app.bicep

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
// Test file for GrafanaExcessiveViewerPermissions.ql
2+
// Contains examples of secure and insecure configurations
3+
4+
// TEST CASE: Insecure - Grafana with excessive viewer permissions
5+
// This should be detected by the query
6+
resource insecureGrafanaViewers 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
7+
name: 'insecure-grafana-viewers'
8+
location: 'eastus'
9+
properties: {
10+
grafanaConfigurations: {
11+
users: {
12+
viewersCanEdit: true // ALERT: Excessive permissions for viewers
13+
}
14+
}
15+
}
16+
sku: {
17+
name: 'Standard'
18+
}
19+
}
20+
21+
// TEST CASE: Secure - Grafana with proper viewer permissions (explicitly set to false)
22+
// This should NOT be detected by the query
23+
resource secureGrafanaViewers 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
24+
name: 'secure-grafana-viewers'
25+
location: 'eastus'
26+
properties: {
27+
grafanaConfigurations: {
28+
users: {
29+
viewersCanEdit: false // Secure: Viewers cannot edit dashboards
30+
}
31+
}
32+
}
33+
sku: {
34+
name: 'Standard'
35+
}
36+
}
37+
38+
// TEST CASE: Secure - Grafana with default viewer permissions (property omitted)
39+
// This should NOT be detected by the query (assuming default is false)
40+
resource defaultGrafanaViewers 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
41+
name: 'default-grafana-viewers'
42+
location: 'eastus'
43+
properties: {
44+
grafanaConfigurations: {
45+
users: {
46+
// viewersCanEdit property is omitted, should default to false
47+
}
48+
}
49+
}
50+
sku: {
51+
name: 'Standard'
52+
}
53+
}

‎ql/test/queries-tests/security/CWE-295/GrafanaSmtpSslVerificationDisabled/GrafanaSmtpSslVerificationDisabled.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| app.bicep:18:21:18:24 | true | Grafana SMTP configuration has SSL verification disabled (skipVerify=true), which can lead to man-in-the-middle attacks. |

‎ql/test/queries-tests/security/CWE-295/GrafanaSmtpSslVerificationDisabled/GrafanaSmtpSslVerificationDisabled.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-295/GrafanaSmtpSslVerificationDisabled.ql

‎ql/test/queries-tests/security/CWE-295/GrafanaSmtpSslVerificationDisabled/app.bicep

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
// Test file for GrafanaSmtpSslVerificationDisabled.ql
2+
// Contains examples of secure and insecure configurations
3+
4+
// TEST CASE: Insecure - Grafana with SMTP SSL verification disabled
5+
// This should be detected by the query
6+
resource insecureGrafanaSmtp 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
7+
name: 'insecure-grafana-smtp'
8+
location: 'eastus'
9+
properties: {
10+
grafanaConfigurations: {
11+
smtp: {
12+
enabled: true
13+
host: 'smtp.example.com:587'
14+
user: 'grafanauser'
15+
password: 'password123'
16+
fromAddress: 'grafana@example.com'
17+
fromName: 'Grafana Alerts'
18+
skipVerify: true // ALERT: SSL verification is disabled
19+
startTLSPolicy: 'MandatoryStartTLS'
20+
}
21+
}
22+
}
23+
sku: {
24+
name: 'Standard'
25+
}
26+
}
27+
28+
// TEST CASE: Secure - Grafana with SMTP SSL verification enabled
29+
// This should NOT be detected by the query
30+
resource secureGrafanaSmtp 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
31+
name: 'secure-grafana-smtp'
32+
location: 'eastus'
33+
properties: {
34+
grafanaConfigurations: {
35+
smtp: {
36+
enabled: true
37+
host: 'smtp.example.com:587'
38+
user: 'grafanauser'
39+
password: 'password123'
40+
fromAddress: 'grafana@example.com'
41+
fromName: 'Grafana Alerts'
42+
skipVerify: false // Secure: SSL verification is enabled
43+
startTLSPolicy: 'MandatoryStartTLS'
44+
}
45+
}
46+
}
47+
sku: {
48+
name: 'Standard'
49+
}
50+
}
51+
52+
// TEST CASE: Secure - Grafana with SMTP but no skipVerify setting (should default to false)
53+
// This should NOT be detected by the query
54+
resource defaultSecureGrafanaSmtp 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
55+
name: 'default-grafana-smtp'
56+
location: 'eastus'
57+
properties: {
58+
grafanaConfigurations: {
59+
smtp: {
60+
enabled: true
61+
host: 'smtp.example.com:587'
62+
user: 'grafanauser'
63+
password: 'password123'
64+
fromAddress: 'grafana@example.com'
65+
fromName: 'Grafana Alerts'
66+
// skipVerify not set, defaults to false
67+
startTLSPolicy: 'MandatoryStartTLS'
68+
}
69+
}
70+
}
71+
sku: {
72+
name: 'Standard'
73+
}
74+
}
75+
76+
// TEST CASE: Edge case - Grafana with SMTP disabled
77+
// This should NOT be detected by the query even though skipVerify is true
78+
resource disabledSmtpGrafana 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
79+
name: 'disabled-smtp-grafana'
80+
location: 'eastus'
81+
properties: {
82+
grafanaConfigurations: {
83+
smtp: {
84+
enabled: false
85+
skipVerify: true // This shouldn't trigger the alert because SMTP is disabled
86+
}
87+
}
88+
}
89+
sku: {
90+
name: 'Standard'
91+
}
92+
}

‎ql/test/queries-tests/security/CWE-306/GrafanaApiKeyEnabled/GrafanaApiKeyEnabled.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| app.bicep:10:13:10:21 | String | Grafana API key feature is enabled, which can increase the attack surface. Consider disabling API keys if not strictly necessary. |

‎ql/test/queries-tests/security/CWE-306/GrafanaApiKeyEnabled/GrafanaApiKeyEnabled.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-306/GrafanaApiKeyEnabled.ql

‎ql/test/queries-tests/security/CWE-306/GrafanaApiKeyEnabled/app.bicep

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
// Test file for GrafanaApiKeyEnabled.ql
2+
// Contains examples of secure and insecure configurations
3+
4+
// TEST CASE: Insecure - Grafana with API key feature enabled
5+
// This should be detected by the query
6+
resource insecureGrafanaApiKey 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
7+
name: 'insecure-grafana-apikey'
8+
location: 'eastus'
9+
properties: {
10+
apiKey: 'Enabled' // ALERT: API key feature is enabled
11+
}
12+
sku: {
13+
name: 'Standard'
14+
}
15+
}
16+
17+
// TEST CASE: Secure - Grafana with API key feature disabled
18+
// This should NOT be detected by the query
19+
resource secureGrafanaApiKey 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
20+
name: 'secure-grafana-apikey'
21+
location: 'westeurope'
22+
properties: {
23+
apiKey: 'Disabled' // Secure: API key feature is disabled
24+
}
25+
sku: {
26+
name: 'Standard'
27+
}
28+
}
29+
30+
// TEST CASE: Secure - Grafana without explicit API key setting
31+
// This should NOT be detected by the query (assuming default is secure)
32+
resource defaultGrafanaApiKey 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
33+
name: 'default-grafana-apikey'
34+
location: 'centralus'
35+
properties: {
36+
// No explicit API key setting
37+
}
38+
sku: {
39+
name: 'Standard'
40+
}
41+
}

‎ql/test/queries-tests/security/CWE-319/GrafanaInsecureStartTLSPolicy/GrafanaInsecureStartTLSPolicy.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| app.bicep:13:25:13:36 | String | Insecure StartTLS policy 'NoStartTLS' configured in Grafana SMTP settings. This may allow email communications to be sent unencrypted. Use 'MandatoryStartTLS' instead. |
2+
| app.bicep:33:25:33:47 | String | Insecure StartTLS policy 'OpportunisticStartTLS' configured in Grafana SMTP settings. This may allow email communications to be sent unencrypted. Use 'MandatoryStartTLS' instead. |

‎ql/test/queries-tests/security/CWE-319/GrafanaInsecureStartTLSPolicy/GrafanaInsecureStartTLSPolicy.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-319/GrafanaInsecureStartTLSPolicy.ql

0 commit comments

Comments
 (0)