Skip to content

Commit 09c3c5b

Browse files
GeekMasherGeekMasher
committed
feat(tests): Add Grafana query tests
1 parent ea00dae commit 09c3c5b

24 files changed

+549
-0
lines changed

‎ql/test/queries-tests/security/CWE-200/GrafanaExternalSnapshotsEnabled/GrafanaExternalSnapshotsEnabled.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| app.bicep:11:18:13:7 | Snapshots | External snapshots are enabled in Grafana configuration, which could lead to unintended sharing of dashboard data with external services. |

‎ql/test/queries-tests/security/CWE-200/GrafanaExternalSnapshotsEnabled/GrafanaExternalSnapshotsEnabled.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-200/GrafanaExternalSnapshotsEnabled.ql

‎ql/test/queries-tests/security/CWE-200/GrafanaExternalSnapshotsEnabled/app.bicep

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// Test file for GrafanaExternalSnapshotsEnabled.ql
2+
// Contains examples of secure and insecure configurations
3+
4+
// TEST CASE: Insecure - Grafana with external snapshots enabled
5+
// This should be detected by the query
6+
resource insecureGrafanaSnapshots 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
7+
name: 'insecure-grafana-snapshots'
8+
location: 'eastus'
9+
properties: {
10+
grafanaConfigurations: {
11+
snapshots: {
12+
externalEnabled: true // ALERT: External snapshots are enabled
13+
}
14+
}
15+
}
16+
sku: {
17+
name: 'Standard'
18+
}
19+
}
20+
21+
// TEST CASE: Secure - Grafana with external snapshots disabled
22+
// This should NOT be detected by the query
23+
resource secureGrafanaSnapshots 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
24+
name: 'secure-grafana-snapshots'
25+
location: 'eastus'
26+
properties: {
27+
grafanaConfigurations: {
28+
snapshots: {
29+
externalEnabled: false // Secure: External snapshots are disabled
30+
}
31+
}
32+
}
33+
sku: {
34+
name: 'Standard'
35+
}
36+
}
37+
38+
// TEST CASE: Secure - Grafana with default snapshot settings (property omitted)
39+
// This should NOT be detected by the query (assuming default is false)
40+
resource defaultGrafanaSnapshots 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
41+
name: 'default-grafana-snapshots'
42+
location: 'eastus'
43+
properties: {
44+
grafanaConfigurations: {
45+
// snapshots property omitted
46+
}
47+
}
48+
sku: {
49+
name: 'Standard'
50+
}
51+
}

‎ql/test/queries-tests/security/CWE-272/GrafanaExcessiveEditorPermissions/GrafanaExcessiveEditorPermissions.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| app.bicep:11:14:13:7 | Users | Excessive permissions granted to Grafana editors (editorsCanAdmin=true). This allows editors to administrate dashboards, folders and teams they create. |
2+
| app.bicep:62:14:65:7 | Users | Excessive permissions granted to Grafana editors (editorsCanAdmin=true). This allows editors to administrate dashboards, folders and teams they create. |

‎ql/test/queries-tests/security/CWE-272/GrafanaExcessiveEditorPermissions/GrafanaExcessiveEditorPermissions.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-272/GrafanaExcessiveEditorPermissions.ql

‎ql/test/queries-tests/security/CWE-272/GrafanaExcessiveEditorPermissions/app.bicep

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
// Test file for GrafanaExcessiveEditorPermissions.ql
2+
// Contains examples of secure and insecure configurations
3+
4+
// TEST CASE: Insecure - Grafana with excessive editor permissions
5+
// This should be detected by the query
6+
resource insecureGrafanaEditors 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
7+
name: 'insecure-grafana-editors'
8+
location: 'eastus'
9+
properties: {
10+
grafanaConfigurations: {
11+
users: {
12+
editorsCanAdmin: true // ALERT: Excessive permissions for editors
13+
}
14+
}
15+
}
16+
sku: {
17+
name: 'Standard'
18+
}
19+
}
20+
21+
// TEST CASE: Secure - Grafana with proper editor permissions (explicitly set to false)
22+
// This should NOT be detected by the query
23+
resource secureGrafanaEditors 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
24+
name: 'secure-grafana-editors'
25+
location: 'eastus'
26+
properties: {
27+
grafanaConfigurations: {
28+
users: {
29+
editorsCanAdmin: false // Secure: Editors cannot administrate
30+
}
31+
}
32+
}
33+
sku: {
34+
name: 'Standard'
35+
}
36+
}
37+
38+
// TEST CASE: Secure - Grafana with default editor permissions (property omitted)
39+
// This should NOT be detected by the query (assuming default is false)
40+
resource defaultGrafanaEditors 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
41+
name: 'default-grafana-editors'
42+
location: 'eastus'
43+
properties: {
44+
grafanaConfigurations: {
45+
users: {
46+
// editorsCanAdmin property is omitted, should default to false
47+
}
48+
}
49+
}
50+
sku: {
51+
name: 'Standard'
52+
}
53+
}
54+
55+
// TEST CASE: Complex - Grafana with both viewer and editor permission settings
56+
// The editorsCanAdmin=true should be detected by the query
57+
resource complexGrafana 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
58+
name: 'complex-grafana-permissions'
59+
location: 'eastus'
60+
properties: {
61+
grafanaConfigurations: {
62+
users: {
63+
editorsCanAdmin: true // ALERT: Excessive permissions for editors
64+
viewersCanEdit: false // This is secure, but the resource should still be flagged
65+
}
66+
}
67+
}
68+
sku: {
69+
name: 'Standard'
70+
}
71+
}

‎ql/test/queries-tests/security/CWE-272/GrafanaExcessiveViewerPermissions/GrafanaExcessiveViewerPermissions.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| app.bicep:11:14:13:7 | Users | Excessive permissions granted to Grafana viewers (viewersCanEdit=true). This allows viewers to make temporary edits to dashboards they have access to. |

‎ql/test/queries-tests/security/CWE-272/GrafanaExcessiveViewerPermissions/GrafanaExcessiveViewerPermissions.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security/CWE-272/GrafanaExcessiveViewerPermissions.ql

‎ql/test/queries-tests/security/CWE-272/GrafanaExcessiveViewerPermissions/app.bicep

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
// Test file for GrafanaExcessiveViewerPermissions.ql
2+
// Contains examples of secure and insecure configurations
3+
4+
// TEST CASE: Insecure - Grafana with excessive viewer permissions
5+
// This should be detected by the query
6+
resource insecureGrafanaViewers 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
7+
name: 'insecure-grafana-viewers'
8+
location: 'eastus'
9+
properties: {
10+
grafanaConfigurations: {
11+
users: {
12+
viewersCanEdit: true // ALERT: Excessive permissions for viewers
13+
}
14+
}
15+
}
16+
sku: {
17+
name: 'Standard'
18+
}
19+
}
20+
21+
// TEST CASE: Secure - Grafana with proper viewer permissions (explicitly set to false)
22+
// This should NOT be detected by the query
23+
resource secureGrafanaViewers 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
24+
name: 'secure-grafana-viewers'
25+
location: 'eastus'
26+
properties: {
27+
grafanaConfigurations: {
28+
users: {
29+
viewersCanEdit: false // Secure: Viewers cannot edit dashboards
30+
}
31+
}
32+
}
33+
sku: {
34+
name: 'Standard'
35+
}
36+
}
37+
38+
// TEST CASE: Secure - Grafana with default viewer permissions (property omitted)
39+
// This should NOT be detected by the query (assuming default is false)
40+
resource defaultGrafanaViewers 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
41+
name: 'default-grafana-viewers'
42+
location: 'eastus'
43+
properties: {
44+
grafanaConfigurations: {
45+
users: {
46+
// viewersCanEdit property is omitted, should default to false
47+
}
48+
}
49+
}
50+
sku: {
51+
name: 'Standard'
52+
}
53+
}

‎ql/test/queries-tests/security/CWE-295/GrafanaSmtpSslVerificationDisabled/GrafanaSmtpSslVerificationDisabled.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| app.bicep:18:21:18:24 | true | Grafana SMTP configuration has SSL verification disabled (skipVerify=true), which can lead to man-in-the-middle attacks. |

0 commit comments

Comments
 (0)