Skip to content

Commit c65571e

Browse files
GeekMasherGeekMasher
committed
feat(test): Add tests
1 parent f0efa82 commit c65571e

File tree

4 files changed

+253
-0
lines changed

4 files changed

+253
-0
lines changed

‎ql/test/library-tests/frameworks/web/Web.expected

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
webApps
2+
| app.bicep:7:1:25:1 | (no string representation) |
3+
| app.bicep:28:1:45:1 | AppService[${appServiceName}-insecure] |
4+
| app.bicep:48:1:70:1 | AppService[${appServiceName}-secure] |
5+
| app.bicep:73:1:84:1 | DeploymentSlot[${MemberExpression}/staging] |
6+
| app.bicep:87:1:100:1 | (no string representation) |
7+
| app.bicep:103:1:115:1 | AppService[${appServiceName}-function] |
8+
| test-sites.bicep:9:1:16:1 | (no string representation) |
9+
| test-sites.bicep:19:1:72:1 | (no string representation) |
10+
| test-sites.bicep:75:1:107:1 | (no string representation) |
11+
webSites
12+
| app.bicep:28:1:45:1 | AppService[${appServiceName}-insecure] |
13+
| app.bicep:48:1:70:1 | AppService[${appServiceName}-secure] |
14+
| app.bicep:103:1:115:1 | AppService[${appServiceName}-function] |
15+
| test-sites.bicep:19:1:72:1 | (no string representation) |
16+
| test-sites.bicep:75:1:107:1 | (no string representation) |
17+
webSlots
18+
| app.bicep:73:1:84:1 | DeploymentSlot[${MemberExpression}/staging] |
19+
webServerFarms
20+
| app.bicep:7:1:25:1 | (no string representation) |
21+
| test-sites.bicep:9:1:16:1 | (no string representation) |

‎ql/test/library-tests/frameworks/web/Web.ql

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
private import bicep
2+
import codeql.bicep.frameworks.Microsoft.Web
3+
4+
query predicate webApps(Web::WebResource web) { any() }
5+
6+
query predicate webSites(Web::SitesResource sites) { any() }
7+
8+
query predicate webSlots(Web::SlotResource slots) { any() }
9+
10+
query predicate webServerFarms(Web::ServerFarmsResource serverFarm) { any() }

‎ql/test/library-tests/frameworks/web/app.bicep

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
param location string = resourceGroup().location
2+
param appServicePlanName string = 'myAppServicePlan'
3+
param appServiceName string = 'myAppService'
4+
param staticSiteName string = 'myStaticSite'
5+
6+
// App Service Plan
7+
resource appServicePlan 'Microsoft.Web/serverfarms@2022-09-01' = {
8+
name: appServicePlanName
9+
location: location
10+
sku: {
11+
name: 'S1'
12+
tier: 'Standard'
13+
}
14+
properties: {
15+
reserved: true // For Linux
16+
computeMode: 'Dedicated'
17+
workerSize: 'Small'
18+
workerSizeId: 1
19+
numberOfWorkers: 2
20+
perSiteScaling: false
21+
elasticScaleEnabled: true
22+
zoneRedundant: true
23+
maximumElasticWorkerCount: 10
24+
}
25+
}
26+
27+
// App Service with insecure configuration (for testing queries)
28+
resource insecureAppService 'Microsoft.Web/sites@2022-09-01' = {
29+
name: '${appServiceName}-insecure'
30+
location: location
31+
kind: 'app'
32+
properties: {
33+
serverFarmId: appServicePlan.id
34+
httpsOnly: false // Insecure setting
35+
publicNetworkAccess: 'Enabled'
36+
clientCertEnabled: false
37+
siteConfig: {
38+
minTlsVersion: '1.0' // Weak TLS
39+
remoteDebuggingEnabled: true // Insecure
40+
ftpsState: 'AllAllowed'
41+
http20Enabled: false
42+
alwaysOn: true
43+
}
44+
}
45+
}
46+
47+
// App Service with secure configuration
48+
resource secureAppService 'Microsoft.Web/sites@2022-09-01' = {
49+
name: '${appServiceName}-secure'
50+
location: location
51+
kind: 'app'
52+
identity: {
53+
type: 'SystemAssigned'
54+
}
55+
properties: {
56+
serverFarmId: appServicePlan.id
57+
httpsOnly: true
58+
publicNetworkAccess: 'Disabled'
59+
clientCertEnabled: true
60+
clientCertMode: 'Required'
61+
siteConfig: {
62+
minTlsVersion: '1.2'
63+
remoteDebuggingEnabled: false
64+
ftpsState: 'Disabled'
65+
http20Enabled: true
66+
alwaysOn: true
67+
}
68+
virtualNetworkSubnetId: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myRG/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet'
69+
}
70+
}
71+
72+
// Deployment slot for testing
73+
resource testSlot 'Microsoft.Web/sites/slots@2022-09-01' = {
74+
name: '${secureAppService.name}/staging'
75+
location: location
76+
kind: 'app'
77+
properties: {
78+
httpsOnly: true
79+
siteConfig: {
80+
minTlsVersion: '1.2'
81+
alwaysOn: true
82+
}
83+
}
84+
}
85+
86+
// Static Web App
87+
resource staticSite 'Microsoft.Web/staticSites@2022-09-01' = {
88+
name: staticSiteName
89+
location: location
90+
sku: {
91+
name: 'Standard'
92+
tier: 'Standard'
93+
}
94+
properties: {
95+
repositoryUrl: 'https://github.com/example/repo'
96+
repositoryToken: 'your-token-here'
97+
allowConfigFileUpdates: true
98+
allowPrivateEndpoints: false
99+
}
100+
}
101+
102+
// Function App (another kind of site)
103+
resource functionApp 'Microsoft.Web/sites@2022-09-01' = {
104+
name: '${appServiceName}-function'
105+
location: location
106+
kind: 'functionapp'
107+
properties: {
108+
serverFarmId: appServicePlan.id
109+
httpsOnly: true
110+
siteConfig: {
111+
minTlsVersion: '1.2'
112+
alwaysOn: true
113+
}
114+
}
115+
}

‎ql/test/library-tests/frameworks/web/test-sites.bicep

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
// This is a test file for Microsoft.Web/sites resources
2+
3+
param location string = 'eastus'
4+
param appServicePlanName string = 'test-asp'
5+
param webAppName string = 'test-webapp'
6+
param functionAppName string = 'test-function-app'
7+
8+
// App Service Plan
9+
resource appServicePlan 'Microsoft.Web/serverfarms@2022-03-01' = {
10+
name: appServicePlanName
11+
location: location
12+
sku: {
13+
name: 'B1'
14+
tier: 'Basic'
15+
}
16+
}
17+
18+
// Web App (App Service)
19+
resource webApp 'Microsoft.Web/sites@2022-03-01' = {
20+
name: webAppName
21+
location: location
22+
kind: 'app'
23+
identity: {
24+
type: 'SystemAssigned'
25+
}
26+
properties: {
27+
serverFarmId: appServicePlan.id
28+
httpsOnly: true
29+
clientCertEnabled: true
30+
clientCertMode: 'Required'
31+
virtualNetworkSubnetId: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyResourceGroup/providers/Microsoft.Network/virtualNetworks/MyVnet/subnets/MySubnet'
32+
siteConfig: {
33+
alwaysOn: true
34+
http20Enabled: true
35+
minTlsVersion: '1.2'
36+
ftpsState: 'FtpsOnly'
37+
ipSecurityRestrictions: [
38+
{
39+
ipAddress: '192.168.1.0/24'
40+
action: 'Allow'
41+
priority: 100
42+
name: 'Allow internal network'
43+
}
44+
{
45+
ipAddress: '10.0.0.0/16'
46+
action: 'Deny'
47+
priority: 200
48+
name: 'Block private network'
49+
}
50+
]
51+
ipSecurityRestrictionsDefaultAction: 'Deny'
52+
appSettings: [
53+
{
54+
name: 'WEBSITE_NODE_DEFAULT_VERSION'
55+
value: '~16'
56+
}
57+
{
58+
name: 'APPINSIGHTS_INSTRUMENTATIONKEY'
59+
value: '00000000-0000-0000-0000-000000000000'
60+
}
61+
]
62+
connectionStrings: [
63+
{
64+
name: 'MyDbConnection'
65+
connectionString: 'Data Source=myserver;Initial Catalog=mydb;User ID=myuser;Password=mypassword;'
66+
type: 'SQLAzure'
67+
}
68+
]
69+
linuxFxVersion: 'NODE|16-lts'
70+
}
71+
}
72+
}
73+
74+
// Function App
75+
resource functionApp 'Microsoft.Web/sites@2022-03-01' = {
76+
name: functionAppName
77+
location: location
78+
kind: 'functionapp'
79+
identity: {
80+
type: 'SystemAssigned,UserAssigned'
81+
userAssignedIdentities: {
82+
'/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myIdentity': {}
83+
}
84+
}
85+
properties: {
86+
serverFarmId: appServicePlan.id
87+
httpsOnly: true
88+
siteConfig: {
89+
alwaysOn: true
90+
use32BitWorkerProcess: false
91+
appSettings: [
92+
{
93+
name: 'AzureWebJobsStorage'
94+
value: 'DefaultEndpointsProtocol=https;AccountName=mystorageaccount;EndpointSuffix=core.windows.net;AccountKey=mykey=='
95+
}
96+
{
97+
name: 'FUNCTIONS_EXTENSION_VERSION'
98+
value: '~4'
99+
}
100+
{
101+
name: 'FUNCTIONS_WORKER_RUNTIME'
102+
value: 'node'
103+
}
104+
]
105+
}
106+
}
107+
}

0 commit comments

Comments
 (0)