Create rule S7001: Detect Azure App Service Secrets APPSEC-1846 #4037
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
loris-s-sonarsource
changed the title
|
|
|
|
| "STIG ASD 2023-06-08": [ | ||
| "V-222642" | ||
| ] |
There was a problem hiding this comment.
@loris-s-sonarsource @hendrik-buchwald-sonarsource
Hey. I noticed the CI complains about this:
Rule S7001 failed validation for these reasons:
- Rule secrets:S7001 has invalid metadata in securityStandards: Additional properties are not allowed ('STIG ASD 2023-06-08' was unexpected)
(The CI only runs this check if the rule is modified or if rspec-tools is modified. I'm in the latter case.)
There was a problem hiding this comment.
PR #4098 modified the name of this metadata section from STIG ASD 2023-06-08 to STIG ASD_V5R3. I think this PR failed to get merged, so was not included in that PR, and then was merged later.
I'll create a PR to update the name of this section.
There was a problem hiding this comment.
Thanks @jamie-anderson-sonarsource. FYI there is this similar other issue: #4040 (comment)
There was a problem hiding this comment.
PR #4144 is now merged and it fixes this issue. I'll open another PR for S7003.
There was a problem hiding this comment.
Thanks, Jamie !
You can preview this rule here (updated a few minutes after each push).
Review
A dedicated reviewer checked the rule description successfully for: