Skip to content

Commit 5e41207

Browse files
GeekMasherGeekMasher
authored
Merge pull request #3 from GitHubSecurityLab/vault
feat: Add KeyVault framework support
2 parents 98dce32 + 23eafa1 commit 5e41207

File tree

6 files changed

+293
-1
lines changed

6 files changed

+293
-1
lines changed

‎ql/lib/codeql/bicep/Frameworks.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
import frameworks.Microsoft.Compute
22
import frameworks.Microsoft.Network
33
import frameworks.Microsoft.Storage
4-
import frameworks.Microsoft.Databases
4+
import frameworks.Microsoft.Databases
5+
import frameworks.Microsoft.KeyVault

‎ql/lib/codeql/bicep/frameworks/Microsoft/KeyVault.qll

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
private import bicep
2+
private import codeql.bicep.Concepts
3+
private import Network
4+
5+
module KeyVault {
6+
class VaultResource extends Resource {
7+
/**
8+
* Constructs a VaultResource for any Microsoft.KeyVault resource type.
9+
*/
10+
VaultResource() { this.getResourceType().regexpMatch("^Microsoft.KeyVault/.*") }
11+
12+
string tenantId() { result = this.getProperties().getTenantId().getValue() }
13+
14+
KeyVaultProperties::Properties getProperties() { result = this.getProperty("properties") }
15+
16+
KeyVaultProperties::AccessPolicy getAccessPolicies() {
17+
result = this.getProperties().getAccessPolicies()
18+
}
19+
20+
Network::NetworkAcl getNetworkAcls() {
21+
result = this.getProperties().getNetworkAcls()
22+
}
23+
24+
override string toString() { result = "Key Vault Resource" }
25+
}
26+
27+
class PublicVaultResource extends PublicResource {
28+
private VaultResource vaultResource;
29+
30+
/**
31+
* Constructs a PublicVaultResource for any Microsoft.KeyVault resource type
32+
* that has public network access enabled.
33+
*/
34+
PublicVaultResource() {
35+
vaultResource.getProperties().publicNetworkAccess() = "Enabled" and
36+
this = vaultResource
37+
}
38+
39+
override Expr getPublicAccessProperty() {
40+
result = vaultResource.getProperties().getPublicNetworkAccess()
41+
}
42+
43+
override string toString() { result = "Public Key Vault Resource" }
44+
}
45+
46+
module KeyVaultProperties {
47+
/**
48+
* The properties object for the Microsoft.KeyVault/vaults type.
49+
*/
50+
class Properties extends Object {
51+
private VaultResource vaultResource;
52+
53+
/**
54+
* Constructs a Properties object for the given Key Vault resource.
55+
*/
56+
Properties() { this = vaultResource.getProperty("properties") }
57+
58+
/**
59+
* Returns the parent VaultResource.
60+
*/
61+
VaultResource getVaultResource() { result = vaultResource }
62+
63+
StringLiteral getTenantId() { result = this.getProperty("tenantId") }
64+
65+
string tenantId() { result = this.getTenantId().getValue() }
66+
67+
StringLiteral getCreateMode() { result = this.getProperty("createMode") }
68+
69+
string createMode() { result = this.getCreateMode().getValue() }
70+
71+
Boolean getEnabledForDeployment() { result = this.getProperty("enabledForDeployment") }
72+
73+
boolean enabledForDeployment() { result = this.getEnabledForDeployment().getBool() }
74+
75+
Boolean getEnabledForDiskEncryption() {
76+
result = this.getProperty("enabledForDiskEncryption")
77+
}
78+
79+
boolean enabledForDiskEncryption() { result = this.getEnabledForDiskEncryption().getBool() }
80+
81+
Boolean getEnabledForTemplateDeployment() {
82+
result = this.getProperty("enabledForTemplateDeployment")
83+
}
84+
85+
boolean enabledForTemplateDeployment() {
86+
result = this.getEnabledForTemplateDeployment().getBool()
87+
}
88+
89+
Boolean getSoftDeleteEnabled() { result = this.getProperty("softDeleteEnabled") }
90+
91+
boolean softDeleteEnabled() { result = this.getSoftDeleteEnabled().getBool() }
92+
93+
Boolean getPurgeProtectionEnabled() { result = this.getProperty("purgeProtectionEnabled") }
94+
95+
boolean purgeProtectionEnabled() { result = this.getPurgeProtectionEnabled().getBool() }
96+
97+
StringLiteral getPublicNetworkAccess() { result = this.getProperty("publicNetworkAccess") }
98+
99+
string publicNetworkAccess() { result = this.getPublicNetworkAccess().getValue() }
100+
101+
Network::NetworkAcl getNetworkAcls() {
102+
result = this.getProperty("networkAcls")
103+
}
104+
105+
AccessPolicy getAccessPolicies() {
106+
result = this.getProperty("accessPolicies").(Array).getElements()
107+
}
108+
109+
AccessPolicy getAccessPolicy(int index) {
110+
result = this.getProperty("accessPolicies").(Array).getElement(index)
111+
}
112+
}
113+
114+
class AccessPolicy extends Object {
115+
private KeyVaultProperties::Properties properties;
116+
117+
/**
118+
* Constructs an AccessPolicy object for the given Key Vault properties.
119+
*/
120+
AccessPolicy() { this = properties.getProperty("accessPolicies").(Array).getElements() }
121+
122+
/**
123+
* Returns the tenant ID of the access policy.
124+
*/
125+
string getTenantId() { result = this.getProperty("tenantId").(StringLiteral).getValue() }
126+
127+
/**
128+
* Returns the object ID of the access policy.
129+
*/
130+
string getObjectId() { result = this.getProperty("objectId").(StringLiteral).getValue() }
131+
132+
string toString() { result = "AccessPolicy" }
133+
}
134+
135+
class AccessPolicyPermissions extends Object {
136+
private AccessPolicy accessPolicy;
137+
138+
/**
139+
* Constructs an AccessPolicyPermissions object for the given access policy.
140+
*/
141+
AccessPolicyPermissions() { this = accessPolicy.getProperty("permissions") }
142+
143+
Array getCertificates() { result = this.getProperty("certificates") }
144+
145+
StringLiteral getCertificate(int index) { result = this.getCertificates().getElement(index) }
146+
147+
Array getKeys() { result = this.getProperty("keys") }
148+
149+
StringLiteral getKey(int index) { result = this.getKeys().getElement(index) }
150+
151+
Array getSecrets() { result = this.getProperty("secrets") }
152+
153+
StringLiteral getSecret(int index) { result = this.getSecrets().getElement(index) }
154+
155+
Array getStorages() { result = this.getProperty("storage") }
156+
157+
StringLiteral getStorage(int index) { result = this.getStorages().getElement(index) }
158+
159+
string toString() { result = "AccessPolicyPermissions" }
160+
}
161+
}
162+
}

‎ql/lib/codeql/bicep/frameworks/Microsoft/Network.qll

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,62 @@ module Network {
112112
}
113113
}
114114

115+
116+
class NetworkAcl extends Object {
117+
private Resource resource;
118+
119+
NetworkAcl() {
120+
exists(Object props |
121+
props = resource.getProperty("properties") and
122+
this = props.getProperty(["networkAcl", "networkAcls"])
123+
)
124+
}
125+
126+
Resource getResource() { result = resource }
127+
128+
StringLiteral getBypass() {
129+
result = this.getProperty("bypass")
130+
}
131+
132+
string bypass() {
133+
result = this.getBypass().getValue()
134+
}
135+
136+
StringLiteral getDefaultAction() {
137+
result = this.getProperty("defaultAction")
138+
}
139+
140+
string defaultAction() {
141+
result = this.getDefaultAction().getValue()
142+
}
143+
144+
IpRule getIpRules() {
145+
result = this.getProperty("ipRules").(Array).getElements()
146+
}
147+
148+
string toString() {
149+
result = "Network ACL"
150+
}
151+
}
152+
153+
class IpRule extends Object {
154+
private NetworkAcl acl;
155+
156+
IpRule() {
157+
this = acl.getProperty("ipRules").(Array).getElements()
158+
}
159+
160+
NetworkAcl getNetworkAcl() { result = acl }
161+
162+
StringLiteral getValue() {
163+
result = this.getProperty("value")
164+
}
165+
166+
string toString() {
167+
result = "IP Rule"
168+
}
169+
}
170+
115171
module VirtualNetworkProperties {
116172
/**
117173
* The properties object for the Microsoft.Network/virtualNetworks/subnets type.

‎ql/test/library-tests/frameworks/vaults/Vaults.expected

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
keyvault
2+
| app.bicep:1:1:51:1 | Key Vault Resource |
3+
keyvaultPolicies
4+
| app.bicep:1:1:51:1 | Key Vault Resource | app.bicep:11:7:19:7 | AccessPolicy |
5+
| app.bicep:1:1:51:1 | Key Vault Resource | app.bicep:20:7:28:7 | AccessPolicy |
6+
keyvaultNetworkAcls
7+
| app.bicep:1:1:51:1 | Key Vault Resource | app.bicep:36:18:49:5 | Network ACL |

‎ql/test/library-tests/frameworks/vaults/Vaults.ql

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
import bicep
2+
3+
query predicate keyvault(KeyVault::VaultResource vault) { any() }
4+
5+
query predicate keyvaultPolicies(
6+
KeyVault::VaultResource vault, KeyVault::KeyVaultProperties::AccessPolicy policy
7+
) {
8+
policy = vault.getAccessPolicies()
9+
}
10+
11+
query predicate keyvaultNetworkAcls(
12+
KeyVault::VaultResource vault, Network::NetworkAcl networkAcl
13+
) {
14+
networkAcl = vault.getNetworkAcls()
15+
}

‎ql/test/library-tests/frameworks/vaults/app.bicep

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
resource keyVault 'Microsoft.KeyVault/vaults@2021-06-01-preview' = {
2+
name: 'mykeyvault'
3+
location: 'eastus'
4+
properties: {
5+
tenantId: '00000000-0000-0000-0000-000000000000'
6+
sku: {
7+
family: 'A'
8+
name: 'standard'
9+
}
10+
accessPolicies: [
11+
{
12+
tenantId: '00000000-0000-0000-0000-000000000000'
13+
objectId: '11111111-1111-1111-1111-111111111111'
14+
permissions: {
15+
keys: [ 'get', 'list' ]
16+
secrets: [ 'get' ]
17+
certificates: []
18+
}
19+
},
20+
{
21+
tenantId: '00000000-0000-0000-0000-000000000000'
22+
objectId: '22222222-2222-2222-2222-222222222222'
23+
permissions: {
24+
keys: [ 'get' ]
25+
secrets: [ 'get', 'set' ]
26+
certificates: [ 'get' ]
27+
}
28+
}
29+
]
30+
enabledForDeployment: false
31+
enabledForDiskEncryption: false
32+
enabledForTemplateDeployment: false
33+
enableSoftDelete: true
34+
enablePurgeProtection: true
35+
publicNetworkAccess: 'Disabled' // Recommended: restrict public access
36+
networkAcls: {
37+
bypass: 'AzureServices'
38+
defaultAction: 'Deny'
39+
ipRules: [
40+
{
41+
value: '203.0.113.0/24'
42+
}
43+
]
44+
virtualNetworkRules: [
45+
{
46+
id: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myrg/providers/Microsoft.Network/virtualNetworks/myvnet/subnets/mysubnet'
47+
}
48+
]
49+
}
50+
}
51+
}

0 commit comments

Comments
 (0)