Merge pull request #6984 from Checkmarx/new-queries-update

update(queries): queries severity updates
Checkmarx · Apr 4, 2024 · 217625a · 217625a
2 parents 9b7965b + 2f5913a
commit 217625a
Show file tree

Hide file tree

Showing 167 changed files with 242 additions and 2,847 deletions.
diff --git a/assets/queries/ansible/aws/cloudtrail_sns_topic_name_undefined/metadata.json b/assets/queries/ansible/aws/cloudtrail_sns_topic_name_undefined/metadata.json
@@ -1,7 +1,7 @@
 {
   "id": "5ba316a9-c466-4ec1-8d5b-bc6107dc9a92",
   "queryName": "CloudTrail SNS Topic Name Undefined",
-  "severity": "INFO",
+  "severity": "LOW",
   "category": "Observability",
   "descriptionText": "Check if SNS topic name is set for CloudTrail",
   "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/community/aws/cloudtrail_module.html",

diff --git a/...ueries/ansible/aws/cloudtrail_sns_topic_name_undefined/test/positive_expected_result.json b/...ueries/ansible/aws/cloudtrail_sns_topic_name_undefined/test/positive_expected_result.json
@@ -1,12 +1,12 @@
 [
   {
     "queryName": "CloudTrail SNS Topic Name Undefined",
-    "severity": "INFO",
+    "severity": "LOW",
     "line": 2
   },
   {
     "queryName": "CloudTrail SNS Topic Name Undefined",
-    "severity": "INFO",
+    "severity": "LOW",
     "line": 15
   }
 ]
diff --git a/assets/queries/ansible/aws/ecs_task_definition_with_plaintext_password/metadata.json b/assets/queries/ansible/aws/ecs_task_definition_with_plaintext_password/metadata.json
diff --git a/assets/queries/ansible/aws/ecs_task_definition_with_plaintext_password/query.rego b/assets/queries/ansible/aws/ecs_task_definition_with_plaintext_password/query.rego
diff --git a/assets/queries/ansible/aws/ecs_task_definition_with_plaintext_password/test/negative.yaml b/assets/queries/ansible/aws/ecs_task_definition_with_plaintext_password/test/negative.yaml
diff --git a/assets/queries/ansible/aws/ecs_task_definition_with_plaintext_password/test/positive.yaml b/assets/queries/ansible/aws/ecs_task_definition_with_plaintext_password/test/positive.yaml
diff --git a/...nsible/aws/ecs_task_definition_with_plaintext_password/test/positive_expected_result.json b/...nsible/aws/ecs_task_definition_with_plaintext_password/test/positive_expected_result.json
diff --git a/assets/queries/ansible/aws/iam_role_allows_all_principals_to_assume/metadata.json b/assets/queries/ansible/aws/iam_role_allows_all_principals_to_assume/metadata.json
@@ -1,7 +1,7 @@
 {
   "id": "babdedcf-d859-43da-9a7b-6d72e661a8fd",
   "queryName": "IAM Role Allows All Principals To Assume",
-  "severity": "HIGH",
+  "severity": "MEDIUM",
   "category": "Access Control",
   "descriptionText": "IAM role allows all services or principals to assume it",
   "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/community/aws/iam_managed_policy_module.html",

diff --git a/...s/ansible/aws/iam_role_allows_all_principals_to_assume/test/positive_expected_result.json b/...s/ansible/aws/iam_role_allows_all_principals_to_assume/test/positive_expected_result.json
@@ -1,13 +1,13 @@
 [
   {
     "queryName": "IAM Role Allows All Principals To Assume",
-    "severity": "HIGH",
+    "severity": "MEDIUM",
     "line": 4,
     "fileName": "positive.yaml"
   },
   {
     "queryName": "IAM Role Allows All Principals To Assume",
-    "severity": "HIGH",
+    "severity": "MEDIUM",
     "line": 17,
     "fileName": "positive.yaml"
   }

diff --git a/assets/queries/ansible/aws/user_data_shell_script_is_encoded/metadata.json b/assets/queries/ansible/aws/user_data_shell_script_is_encoded/metadata.json
diff --git a/assets/queries/ansible/aws/user_data_shell_script_is_encoded/query.rego b/assets/queries/ansible/aws/user_data_shell_script_is_encoded/query.rego
diff --git a/assets/queries/ansible/aws/user_data_shell_script_is_encoded/test/negative.yaml b/assets/queries/ansible/aws/user_data_shell_script_is_encoded/test/negative.yaml
diff --git a/assets/queries/ansible/aws/user_data_shell_script_is_encoded/test/positive.yaml b/assets/queries/ansible/aws/user_data_shell_script_is_encoded/test/positive.yaml
diff --git a/.../queries/ansible/aws/user_data_shell_script_is_encoded/test/positive_expected_result.json b/.../queries/ansible/aws/user_data_shell_script_is_encoded/test/positive_expected_result.json
diff --git a/assets/queries/ansible/gcp/cloud_storage_bucket_versioning_disabled/metadata.json b/assets/queries/ansible/gcp/cloud_storage_bucket_versioning_disabled/metadata.json
@@ -1,7 +1,7 @@
 {
   "id": "7814ddda-e758-4a56-8be3-289a81ded929",
   "queryName": "Cloud Storage Bucket Versioning Disabled",
-  "severity": "LOW",
+  "severity": "MEDIUM",
   "category": "Observability",
   "descriptionText": "Cloud Storage Bucket should have versioning enabled",
   "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/google/cloud/gcp_storage_bucket_module.html#parameter-versioning",

diff --git a/...s/ansible/gcp/cloud_storage_bucket_versioning_disabled/test/positive_expected_result.json b/...s/ansible/gcp/cloud_storage_bucket_versioning_disabled/test/positive_expected_result.json
@@ -1,12 +1,12 @@
 [
   {
     "queryName": "Cloud Storage Bucket Versioning Disabled",
-    "severity": "LOW",
+    "severity": "MEDIUM",
     "line": 3
   },
   {
     "queryName": "Cloud Storage Bucket Versioning Disabled",
-    "severity": "LOW",
+    "severity": "MEDIUM",
     "line": 17
   }
 ]
diff --git a/assets/queries/cloudFormation/aws/cloudtrail_sns_topic_name_undefined/metadata.json b/assets/queries/cloudFormation/aws/cloudtrail_sns_topic_name_undefined/metadata.json
@@ -1,7 +1,7 @@
 {
   "id": "3e09413f-471e-40f3-8626-990c79ae63f3",
   "queryName": "CloudTrail SNS Topic Name Undefined",
-  "severity": "INFO",
+  "severity": "LOW",
   "category": "Observability",
   "descriptionText": "Check if SNS topic name is set for CloudTrail",
   "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudtrail-trail.html#cfn-cloudtrail-trail-snstopicname",

diff --git a/...cloudFormation/aws/cloudtrail_sns_topic_name_undefined/test/positive_expected_result.json b/...cloudFormation/aws/cloudtrail_sns_topic_name_undefined/test/positive_expected_result.json
@@ -1,25 +1,25 @@
 [
   {
     "queryName": "CloudTrail SNS Topic Name Undefined",
-    "severity": "INFO",
+    "severity": "LOW",
     "line": 12,
     "fileName": "positive1.yaml"
   },
   {
     "queryName": "CloudTrail SNS Topic Name Undefined",
-    "severity": "INFO",
+    "severity": "LOW",
     "line": 22,
     "fileName": "positive1.yaml"
   },
   {
     "line": 9,
     "fileName": "positive2.json",
     "queryName": "CloudTrail SNS Topic Name Undefined",
-    "severity": "INFO"
+    "severity": "LOW"
   },
   {
     "queryName": "CloudTrail SNS Topic Name Undefined",
-    "severity": "INFO",
+    "severity": "LOW",
     "line": 23,
     "fileName": "positive2.json"
   }

diff --git a/assets/queries/cloudFormation/aws/ecs_task_definition_with_plaintext_password/metadata.json b/assets/queries/cloudFormation/aws/ecs_task_definition_with_plaintext_password/metadata.json
diff --git a/assets/queries/cloudFormation/aws/ecs_task_definition_with_plaintext_password/query.rego b/assets/queries/cloudFormation/aws/ecs_task_definition_with_plaintext_password/query.rego