Skip to content

Commit 78e5c54

Browse files
GeekMasherGeekMasher
committed
feat: Add tests
1 parent ee59940 commit 78e5c54

14 files changed

+469
-0
lines changed

‎ql/test/queries-tests/security/AKS/AKSInsecureNetworkPolicy.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
| aks-security-examples.bicep:2:1:30:1 | ManagedContainerResource | AKS cluster is configured with an insecure or missing network policy, which may allow unwanted pod-to-pod communication. |
2+
| aks-security-examples.bicep:32:1:62:1 | ManagedContainerResource | AKS cluster is configured with an insecure or missing network policy, which may allow unwanted pod-to-pod communication. |
3+
| app.bicep:287:1:307:1 | ManagedContainerResource | AKS cluster is configured with an insecure or missing network policy, which may allow unwanted pod-to-pod communication. |
4+
| app.bicep:310:1:330:1 | ManagedContainerResource | AKS cluster is configured with an insecure or missing network policy, which may allow unwanted pod-to-pod communication. |

‎ql/test/queries-tests/security/AKS/AKSInsecureNetworkPolicy.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-668/AKSInsecureNetworkPolicy.ql

‎ql/test/queries-tests/security/AKS/AKSLocalAccountsEnabled.expected

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
| aks-security-examples.bicep:2:1:30:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
2+
| aks-security-examples.bicep:32:1:62:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
3+
| app.bicep:6:1:22:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
4+
| app.bicep:25:1:41:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
5+
| app.bicep:46:1:66:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
6+
| app.bicep:69:1:86:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
7+
| app.bicep:89:1:106:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
8+
| app.bicep:111:1:130:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
9+
| app.bicep:133:1:150:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
10+
| app.bicep:153:1:170:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
11+
| app.bicep:199:1:216:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
12+
| app.bicep:219:1:236:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
13+
| app.bicep:241:1:261:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
14+
| app.bicep:264:1:284:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
15+
| app.bicep:287:1:307:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
16+
| app.bicep:310:1:330:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
17+
| app.bicep:349:1:366:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |
18+
| app.bicep:369:1:386:1 | ManagedContainerResource | AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication. |

‎ql/test/queries-tests/security/AKS/AKSLocalAccountsEnabled.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-306/AKSLocalAccountsEnabled.ql

‎ql/test/queries-tests/security/AKS/AKSNodeAutoScalingDisabled.expected

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
| aks-security-examples.bicep:9:7:16:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |
2+
| app.bicep:14:7:19:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |
3+
| app.bicep:33:7:38:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |
4+
| app.bicep:58:7:63:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |
5+
| app.bicep:78:7:83:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |
6+
| app.bicep:98:7:103:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |
7+
| app.bicep:141:7:147:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |
8+
| app.bicep:161:7:167:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |
9+
| app.bicep:188:7:193:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |
10+
| app.bicep:208:7:213:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |
11+
| app.bicep:228:7:233:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |
12+
| app.bicep:253:7:258:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |
13+
| app.bicep:276:7:281:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |
14+
| app.bicep:299:7:304:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |
15+
| app.bicep:322:7:327:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |
16+
| app.bicep:358:7:363:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |
17+
| app.bicep:378:7:383:7 | AgentPoolProfile | AKS agent pool 'agentpool' has auto-scaling disabled, which may lead to resource constraints during high load. |

‎ql/test/queries-tests/security/AKS/AKSNodeAutoScalingDisabled.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-400/AKSNodeAutoScalingDisabled.ql

‎ql/test/queries-tests/security/AKS/AKSPrivateApiEnabled.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
| aks-security-examples.bicep:32:1:62:1 | ManagedContainerResource | AKS cluster API server is private (private cluster enabled). |
2+
| app.bicep:46:1:66:1 | ManagedContainerResource | AKS cluster API server is private (private cluster enabled). |

‎ql/test/queries-tests/security/AKS/AKSPublicNetworkAccess.expected

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
| aks-security-examples.bicep:2:1:30:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |
2+
| app.bicep:6:1:22:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |
3+
| app.bicep:25:1:41:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |
4+
| app.bicep:69:1:86:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |
5+
| app.bicep:89:1:106:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |
6+
| app.bicep:111:1:130:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |
7+
| app.bicep:133:1:150:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |
8+
| app.bicep:153:1:170:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |
9+
| app.bicep:175:1:196:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |
10+
| app.bicep:199:1:216:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |
11+
| app.bicep:219:1:236:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |
12+
| app.bicep:241:1:261:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |
13+
| app.bicep:264:1:284:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |
14+
| app.bicep:287:1:307:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |
15+
| app.bicep:310:1:330:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |
16+
| app.bicep:349:1:366:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |
17+
| app.bicep:369:1:386:1 | ManagedContainerResource | AKS cluster has public network access enabled, which can expose the cluster to unauthorized access. |

‎ql/test/queries-tests/security/AKS/AKSPublicNetworkAccess.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-284/AKSPublicNetworkAccess.ql

‎ql/test/queries-tests/security/AKS/AKSRbacDisabled.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| app.bicep:25:1:41:1 | ManagedContainerResource | AKS cluster has RBAC disabled, which can lead to unauthorized access to the cluster. |

‎ql/test/queries-tests/security/AKS/AKSRbacDisabled.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-284/AKSRbacDisabled.ql

‎ql/test/queries-tests/security/AKS/AKSWithoutDiskEncryption.expected

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
| aks-security-examples.bicep:2:1:30:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
2+
| aks-security-examples.bicep:32:1:62:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
3+
| app.bicep:6:1:22:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
4+
| app.bicep:25:1:41:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
5+
| app.bicep:46:1:66:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
6+
| app.bicep:69:1:86:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
7+
| app.bicep:89:1:106:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
8+
| app.bicep:111:1:130:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
9+
| app.bicep:133:1:150:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
10+
| app.bicep:153:1:170:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
11+
| app.bicep:175:1:196:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
12+
| app.bicep:199:1:216:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
13+
| app.bicep:219:1:236:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
14+
| app.bicep:241:1:261:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
15+
| app.bicep:264:1:284:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
16+
| app.bicep:287:1:307:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
17+
| app.bicep:310:1:330:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
18+
| app.bicep:349:1:366:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |
19+
| app.bicep:369:1:386:1 | ManagedContainerResource | AKS cluster is configured without disk encryption, which can expose sensitive data at rest. |

‎ql/test/queries-tests/security/AKS/AKSWithoutDiskEncryption.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-311/AKSWithoutDiskEncryption.ql

0 commit comments

Comments
 (0)