Skip to content

Commit 69ef0d7

Browse files
AkhtarAmirAkhtarAmir
authored
Merge pull request #1722 from aquasecurity/bundles/sync_09_18
syncing with saas
2 parents fb42bb2 + 8415d5c commit 69ef0d7

15 files changed

+145
-427
lines changed

‎collectors/aws/ses/getIdentityDkimAttributes.js

Lines changed: 39 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,46 @@ var helpers = require(__dirname + '/../../../helpers/aws');
33

44
module.exports = function(AWSConfig, collection, retries, callback) {
55
var ses = new AWS.SES(AWSConfig);
6+
collection.ses.getIdentityDkimAttributes[AWSConfig.region] = {};
67

7-
helpers.makeCustomCollectorCall(ses, 'getIdentityDkimAttributes', {Identities: collection.ses.listIdentities[AWSConfig.region].data}, retries, null, null, null, function(err, data) {
8-
if (err) {
9-
collection.ses.getIdentityDkimAttributes[AWSConfig.region].err = err;
8+
var identities = collection.ses.listIdentities[AWSConfig.region].data;
9+
var identityChunks = chunkArray(identities, 100);
10+
var allDkimAttributes = [];
11+
var processIdentityChunk = function(chunkIndex) {
12+
if (chunkIndex >= identityChunks.length) {
13+
allDkimAttributes = allDkimAttributes.flatMap(obj => Object.values(obj));
14+
collection.ses.getIdentityDkimAttributes[AWSConfig.region].data = {
15+
DkimAttributes: allDkimAttributes
16+
};
17+
callback();
18+
return;
1019
}
1120

12-
collection.ses.getIdentityDkimAttributes[AWSConfig.region].data = data;
21+
var chunk = identityChunks[chunkIndex];
22+
var params = {
23+
Identities: chunk,
24+
};
1325

14-
callback();
15-
});
16-
};
26+
setTimeout(function() {
27+
helpers.makeCustomCollectorCall(ses, 'getIdentityDkimAttributes', params, retries, null, null, null, function(err, data) {
28+
if (err) {
29+
collection.ses.getIdentityDkimAttributes[AWSConfig.region].err = err;
30+
} else if (data && data.DkimAttributes) {
31+
allDkimAttributes = allDkimAttributes.concat(data.DkimAttributes);
32+
}
33+
34+
processIdentityChunk(chunkIndex + 1);
35+
});
36+
}, 1000);
37+
};
38+
39+
processIdentityChunk(0);
40+
};
41+
42+
function chunkArray(arr, chunkSize) {
43+
var result = [];
44+
for (var i = 0; i < arr.length; i += chunkSize) {
45+
result.push(arr.slice(i, i + chunkSize));
46+
}
47+
return result;
48+
}

‎collectors/azure/collector.js

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ function parseCollection(path, obj) {
4444
}
4545
}
4646

47-
var collect = function(AzureConfig, settings, callback) {
47+
let collect = function(AzureConfig, settings, callback) {
4848
// Used to gather info only
4949
if (settings.gather) {
5050
return callback(null, calls, postcalls, tertiarycalls, specialcalls);
@@ -92,10 +92,12 @@ var collect = function(AzureConfig, settings, callback) {
9292
});
9393
};
9494

95-
var processCall = function(obj, cb, localData) {
96-
var localUrl = obj.nextUrl || obj.url.replace(/\{subscriptionId\}/g, AzureConfig.SubscriptionID);
95+
let processCall = function(obj, cb, localData) {
96+
let localUrl = obj.nextUrl || obj.url.replace(/\{subscriptionId\}/g, AzureConfig.SubscriptionID);
9797
if (obj.rateLimit) {
9898
setTimeout(function() {
99+
console.log('timeout check');
100+
console.log(`url: ${localUrl} obj: ${JSON.stringify(obj)} localData: ${JSON.stringify(localData)}`);
99101
makeCall(localUrl, obj, cb, localData);
100102
}, obj.rateLimit);
101103
} else {

‎collectors/azure/fileService/listSharesSegmented.js

Lines changed: 31 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,9 @@
11
var async = require('async');
2+
var azureStorage = require('@azure/storage-file-share');
23

34
module.exports = function(collection, reliesOn, callback) {
45
if (!reliesOn['storageAccounts.listKeys']) return callback();
56

6-
var azureStorage = require('azure-storage');
7-
87
if (!collection['fileService']['listSharesSegmented']) collection['fileService']['listSharesSegmented'] = {};
98
if (!collection['fileService']['getShareAcl']) collection['fileService']['getShareAcl'] = {};
109

@@ -13,39 +12,42 @@ module.exports = function(collection, reliesOn, callback) {
1312
collection['fileService']['listSharesSegmented'][region] = {};
1413
collection['fileService']['getShareAcl'][region] = {};
1514

16-
async.eachOfLimit(regionObj, 5, function(subObj, resourceId, sCb) {
15+
async.eachOfLimit(regionObj, 5, async function(subObj, resourceId, sCb) {
1716
collection['fileService']['listSharesSegmented'][region][resourceId] = {};
1817

1918
if (subObj && subObj.data && subObj.data.keys && subObj.data.keys[0] && subObj.data.keys[0].value) {
2019
// Extract storage account name from resourceId
21-
var storageAccountName = resourceId.substring(resourceId.lastIndexOf('/') + 1);
22-
var storageService = new azureStorage['FileService'](storageAccountName, subObj.data.keys[0].value);
23-
24-
storageService.listSharesSegmented(null, function(serviceErr, serviceResults) {
25-
if (serviceErr || !serviceResults) {
26-
collection['fileService']['listSharesSegmented'][region][resourceId].err = (serviceErr || 'No data returned');
27-
sCb();
28-
} else {
29-
collection['fileService']['listSharesSegmented'][region][resourceId].data = serviceResults.entries;
30-
31-
// Add ACLs
32-
async.eachLimit(serviceResults.entries, 10, function(entryObj, entryCb) {
33-
var entryId = `${resourceId}/fileService/${entryObj.name}`;
34-
collection['fileService']['getShareAcl'][region][entryId] = {};
35-
36-
storageService.getShareAcl(entryObj.name, function(getErr, getData) {
37-
if (getErr || !getData) {
38-
collection['fileService']['getShareAcl'][region][entryId].err = (getErr || 'No data returned');
39-
} else {
40-
collection['fileService']['getShareAcl'][region][entryId].data = getData;
41-
}
42-
entryCb();
20+
const shareItemList = [];
21+
try {
22+
const storageAccountName = resourceId.substring(resourceId.lastIndexOf('/') + 1);
23+
const connectionString = `DefaultEndpointsProtocol=https;AccountName=${storageAccountName};AccountKey=${subObj.data.keys[0].value};EndpointSuffix=core.windows.net`;
24+
const storageService = azureStorage.ShareServiceClient.fromConnectionString(connectionString);
25+
const iterator = storageService.listShares();
26+
let item = await iterator.next();
27+
28+
while (!item.done) {
29+
let fileShare = item.value.name;
30+
var entryId = `${resourceId}/fileService/${fileShare}`;
31+
shareItemList.push({ name: fileShare, id: entryId});
32+
collection['fileService']['getShareAcl'][region][entryId] = {};
33+
const shareClient = storageService.getShareClient(fileShare);
34+
shareClient.getAccessPolicy()
35+
.then(result => {
36+
collection['fileService']['getShareAcl'][region][entryId].data = result;
37+
})
38+
.catch(err => {
39+
collection['fileService']['getShareAcl'][region][entryId].err = err;
4340
});
44-
}, function() {
45-
sCb();
46-
});
41+
item = await iterator.next();
4742
}
48-
});
43+
} catch (exception) {
44+
collection['fileService']['listSharesSegmented'][region][resourceId].err = exception.message;
45+
}
46+
if (shareItemList.length) {
47+
collection['fileService']['listSharesSegmented'][region][resourceId].data = shareItemList;
48+
} else {
49+
collection['fileService']['listSharesSegmented'][region][resourceId].data = [];
50+
}
4951
} else {
5052
sCb();
5153
}

‎collectors/azure/fileService/listSharesSegmentedNew.js

Lines changed: 0 additions & 60 deletions
This file was deleted.

‎exports.js

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -750,7 +750,6 @@ module.exports = {
750750
'bastionHostExists' : require(__dirname + '/plugins/azure/bastion/bastionHostExists.js'),
751751

752752
'logProfileArchiveData' : require(__dirname + '/plugins/azure/monitor/logProfileArchiveData.js'),
753-
'logProfileRetentionPolicy' : require(__dirname + '/plugins/azure/monitor/logProfileRetentionPolicy.js'),
754753
'monitorLogsEnabled' : require(__dirname + '/plugins/azure/monitor/monitorLogsEnabled.js'),
755754
'diagnosticsCapturedCategories' : require(__dirname + '/plugins/azure/monitor/diagnosticsCapturedCategories.js'),
756755
'diagnosticsSettingsEnabled' : require(__dirname + '/plugins/azure/monitor/diagnosticsSettingsEnabled.js'),

‎helpers/azure/api.js

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,15 @@ var serviceMap = {
143143
BridgeResourceNameIdentifier: 'name', BridgeExecutionService: 'Table Service',
144144
BridgeCollectionService: 'tableservice', DataIdentifier: 'data',
145145
},
146+
'File Service':
147+
{
148+
enabled: true, isSingleSource: true, InvAsset: 'fileService', InvService: 'fileService',
149+
InvResourceCategory: 'storage', InvResourceType: 'file_service', BridgeServiceName: 'fileservice',
150+
BridgePluginCategoryName: 'File Service', BridgeProvider: 'Azure', BridgeCall: 'listSharesSegmented',
151+
BridgeArnIdentifier: '', BridgeIdTemplate: '', BridgeResourceType: 'fileService',
152+
BridgeResourceNameIdentifier: 'name', BridgeExecutionService: 'File Service',
153+
BridgeCollectionService: 'fileservice', DataIdentifier: 'data',
154+
},
146155
'SQL Databases':
147156
{
148157
enabled: true, isSingleSource: true, InvAsset: 'database', InvService: 'sql',
@@ -950,10 +959,7 @@ var specialcalls = {
950959
reliesOnPath: ['storageAccounts.listKeys'],
951960
rateLimit: 3000
952961
},
953-
listSharesSegmentedNew: {
954-
reliesOnPath: ['storageAccounts.listKeys'],
955-
rateLimit: 3000
956-
}
962+
sendIntegration: serviceMap['File Service']
957963
},
958964
blobService: {
959965
listContainersSegmented: {

‎helpers/azure/functions.js

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ var shared = require(__dirname + '/../shared.js');
22
var auth = require(__dirname + '/auth.js');
33
var async = require('async');
44

5-
const defualyPolicyAssignments = {
5+
const defualtPolicyAssignments = {
66
adaptiveApplicationControlsMonitoringEffect: 'AuditIfNotExists',
77
diskEncryptionMonitoringEffect: 'AuditIfNotExists',
88
endpointProtectionMonitoringEffect: 'AuditIfNotExists',
@@ -178,8 +178,8 @@ function checkPolicyAssignment(policyAssignments, param, text, results, location
178178

179179
const policyAssignment = policyAssignments.data.find((policyAssignment) => {
180180
return (policyAssignment &&
181-
policyAssignment.displayName &&
182-
policyAssignment.displayName.toLowerCase().includes('asc default'));
181+
policyAssignment.displayName &&
182+
policyAssignment.displayName.toLowerCase().includes('asc default'));
183183
});
184184

185185
if (!policyAssignment) {
@@ -191,16 +191,14 @@ function checkPolicyAssignment(policyAssignments, param, text, results, location
191191
// This check is required to handle a defect in the Azure API that causes
192192
// unmodified ASC policies to return an empty object for parameters: {}
193193
// https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMSZCA4
194-
if (policyAssignment.parameters &&
195-
!Object.keys(policyAssignment.parameters).length) {
196-
addResult(results, 0,
197-
'There ASC Default Policy Assignment includes all plugins', location,
198-
policyAssignment.id);
199-
return;
200-
}
201194

202-
const policyAssignmentStatus = (policyAssignment.parameters && policyAssignment.parameters[param] && policyAssignment.parameters[param].value) ||
203-
defualyPolicyAssignments[param] || '';
195+
// The api used returns empty parameters in case of all the default values,
196+
var policyAssignmentStatus = '';
197+
if (policyAssignment.parameters && Object.keys(policyAssignment.parameters).length) {
198+
policyAssignmentStatus = (policyAssignment.parameters && policyAssignment.parameters[param] && policyAssignment.parameters[param].value) || defualtPolicyAssignments[param] || '';
199+
} else {
200+
policyAssignmentStatus = defualtPolicyAssignments[param]
201+
}
204202

205203
if (!policyAssignmentStatus.length) {
206204
addResult(results, 0,

‎helpers/shared.js

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@ var processIntegration = function(serviceName, settings, collection, calls, post
2020
let localSettings = {};
2121
localSettings = settings;
2222

23+
if (settings.govcloud) {
24+
localEvent.awsOrGov = 'aws-us-gov';
25+
}
26+
2327
localEvent.collection = {};
2428
localEvent.previousCollection = {};
2529

‎plugins/aws/lambda/lambdaOldRuntimes.js

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,14 +36,21 @@ module.exports = {
3636
{ 'id':'nodejs8.10', 'name': 'Node.js 8.10', 'endOfLifeDate': '2020-03-06' },
3737
{ 'id':'nodejs10.x', 'name': 'Node.js 10.x', 'endOfLifeDate': '2022-02-14' },
3838
{ 'id':'nodejs12.x', 'name': 'Node.js 12', 'endOfLifeDate': '2023-03-31'},
39+
{ 'id':'nodejs14.x', 'name': 'Node.js 14', 'endOfLifeDate': '2023-11-27'},
40+
{ 'id':'nodejs16.x', 'name': 'Node.js 16', 'endOfLifeDate': '2024-03-11'},
3941
{ 'id':'dotnetcore3.1', 'name': '.Net Core 3.1', 'endOfLifeDate': '2023-03-31' },
4042
{ 'id':'dotnetcore2.1', 'name': '.Net Core 2.1', 'endOfLifeDate': '2022-04-15' },
4143
{ 'id':'dotnetcore2.0', 'name': '.Net Core 2.0', 'endOfLifeDate': '2018-10-01' },
4244
{ 'id':'dotnetcore1.0', 'name': '.Net Core 1.0', 'endOfLifeDate': '2019-06-27' },
45+
{ 'id':'dotnet7', 'name': '.Net 7', 'endOfLifeDate': '2024-05-14' },
4346
{ 'id':'python2.7', 'name': 'Python 2.7', 'endOfLifeDate': '2022-05-30' },
4447
{ 'id':'python3.5', 'name': 'Python 3.5', 'endOfLifeDate': '2020-09-13' },
4548
{ 'id':'ruby2.5', 'name': 'Ruby 2.5', 'endOfLifeDate': '2022-03-31' },
49+
{ 'id':'ruby2.7', 'name': 'Ruby 2.7', 'endOfLifeDate': '2023-12-07' },
4650
{ 'id':'python3.6', 'name': 'Python 3.6', 'endOfLifeDate': '2022-08-29'},
51+
{ 'id':'python3.7', 'name': 'Python 3.7', 'endOfLifeDate': '2023-11-27'},
52+
{ 'id':'go1.x', 'name': 'Go 1', 'endOfLifeDate': '2023-12-31'},
53+
{ 'id':'java8', 'name': 'Java 8', 'endOfLifeDate': '2023-12-31'},
4754
];
4855

4956
async.each(regions.lambda, function(region, rcb){

‎plugins/azure/fileservice/fileServiceAllAccessAcl.js

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ module.exports = {
99
description: 'Ensures file shares do not allow full write, delete, or read ACL permissions',
1010
more_info: 'File shares can be configured to allow to read, write, or delete permissions from a share. This option should not be configured unless there is a strong business requirement.',
1111
recommended_action: 'Disable global read, write, and delete policies on all file shares and ensure the share ACL is configured with least privileges.',
12-
link: 'https://learn.microsoft.com/en-us/azure/storage/files/storage-how-to-create-file-share#create-a-file-share-through-the-azure-portal',
13-
apis: ['storageAccounts:list', 'storageAccounts:listKeys', 'fileService:listSharesSegmentedNew', 'fileService:getShareAcl'],
12+
link: 'https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-create-file-share#create-a-file-share-through-the-azure-portal',
13+
apis: ['storageAccounts:list', 'storageAccounts:listKeys', 'fileService:listSharesSegmented', 'fileService:getShareAcl'],
1414
compliance: {
1515
hipaa: 'HIPAA access controls require data to be secured with least-privileged ' +
1616
'ACLs. File Service ACLs enable granular permissions for data access.',
@@ -60,7 +60,6 @@ module.exports = {
6060
'No existing File Service shares found', location, storageAccount.id);
6161
} else {
6262
listSharesSegmented.data.forEach(function(fileShare) {
63-
fileShare.id = `${storageAccount.id}/fileService/${fileShare.name}`;
6463
// Add share ACL
6564
var getShareAcl = helpers.addSource(cache, source,
6665
['fileService', 'getShareAcl', location, fileShare.id]);

‎plugins/azure/fileservice/fileServiceAllAccessAcl.spec.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,8 @@ const listKeys = [
4040

4141
const listSharesSegmented = [
4242
{
43-
"name": "file1 "
43+
"name": "file1",
44+
"id": "/subscriptions/1234/resourceGroups/cloud-shell-storage-eastus/providers/Microsoft.Storage/storageAccounts/csb100320011e293683/fileService/file1"
4445
}
4546
];
4647

0 commit comments

Comments
 (0)