Skip to content

Commit 29c277f

Browse files
GeekMasherGeekMasher
committed
feat: Add Cache support
1 parent 5e41207 commit 29c277f

File tree

7 files changed

+285
-15
lines changed

7 files changed

+285
-15
lines changed

‎ql/lib/codeql/bicep/Frameworks.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1+
import frameworks.Microsoft.Cache
12
import frameworks.Microsoft.Compute
3+
import frameworks.Microsoft.General
24
import frameworks.Microsoft.Network
35
import frameworks.Microsoft.Storage
46
import frameworks.Microsoft.Databases

‎ql/lib/codeql/bicep/frameworks/Microsoft/Cache.qll‎

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
private import bicep
2+
private import codeql.bicep.Concepts
3+
4+
module Cache {
5+
abstract class CacheResource extends Resource { }
6+
7+
/**
8+
* Represents an Azure Cache for Redis resource.
9+
*/
10+
class RedisCacheResource extends CacheResource, Resource {
11+
/**
12+
* Constructs a RedisCacheResource for Microsoft.Cache/Redis resources.
13+
*/
14+
RedisCacheResource() { this.getResourceType().regexpMatch("^Microsoft.Cache/Redis@.*") }
15+
16+
/**
17+
* Returns the properties object for the Redis cache resource.
18+
*/
19+
CacheProperties::Properties getProperties() { result = this.getProperty("properties") }
20+
21+
CacheProperties::RedisConfiguration getRedisConfiguration() {
22+
result = this.getProperties().getProperty("redisConfiguration")
23+
}
24+
25+
/**
26+
* Returns the SKU of the Redis cache.
27+
*/
28+
Sku getSku() { result = this.getProperty("sku") }
29+
30+
/**
31+
* Returns the Redis version.
32+
*/
33+
string redisVersion() {
34+
result = this.getProperties().getProperty("redisVersion").(StringLiteral).getValue()
35+
}
36+
37+
/**
38+
* Returns true if non-SSL port is enabled.
39+
*/
40+
boolean enableNonSslPort() {
41+
result = this.getProperties().getProperty("enableNonSslPort").(Boolean).getBool()
42+
}
43+
44+
/**
45+
* Returns the publicNetworkAccess property, if present.
46+
*/
47+
string publicNetworkAccess() {
48+
result = this.getProperties().getProperty("publicNetworkAccess").(StringLiteral).getValue()
49+
}
50+
51+
/**
52+
* Returns a string representation of the Redis cache resource.
53+
*/
54+
override string toString() { result = "RedisCacheResource" }
55+
}
56+
57+
/**
58+
* Represents a public Azure Cache for Redis resource (public network access enabled).
59+
*/
60+
class PublicRedisCacheResource extends PublicResource {
61+
private RedisCacheResource redisCache;
62+
63+
/**
64+
* Constructs a PublicRedisCacheResource if the Redis cache has public network access enabled.
65+
*/
66+
PublicRedisCacheResource() {
67+
redisCache.publicNetworkAccess() = "Enabled" and
68+
this = redisCache
69+
}
70+
71+
/**
72+
* Returns the property that indicates public access for the Redis cache resource.
73+
*/
74+
override Expr getPublicAccessProperty() {
75+
result = redisCache.getProperties().getProperty("publicNetworkAccess")
76+
}
77+
}
78+
79+
module CacheProperties {
80+
/**
81+
* Represents the properties object for a Redis cache resource.
82+
*/
83+
class Properties extends Object {
84+
private RedisCacheResource redisCache;
85+
86+
/**
87+
* Constructs a Properties object for the given Redis cache resource.
88+
*/
89+
Properties() { this = redisCache.getProperty("properties") }
90+
91+
/**
92+
* Returns the parent RedisCacheResource.
93+
*/
94+
RedisCacheResource getRedisCacheResource() { result = redisCache }
95+
96+
string toString() { result = "CacheProperties" }
97+
}
98+
99+
// redisConfiguration: {
100+
// aad-enabled: 'string'
101+
// aof-backup-enabled: 'string'
102+
// aof-storage-connection-string-0: 'string'
103+
// aof-storage-connection-string-1: 'string'
104+
// authnotrequired: 'string'
105+
// maxfragmentationmemory-reserved: 'string'
106+
// maxmemory-delta: 'string'
107+
// maxmemory-policy: 'string'
108+
// maxmemory-reserved: 'string'
109+
// notify-keyspace-events: 'string'
110+
// preferred-data-persistence-auth-method: 'string'
111+
// rdb-backup-enabled: 'string'
112+
// rdb-backup-frequency: 'string'
113+
// rdb-backup-max-snapshot-count: 'string'
114+
// rdb-storage-connection-string: 'string'
115+
// storage-subscription-id: 'string'
116+
// }
117+
class RedisConfiguration extends Object {
118+
private Properties properties;
119+
120+
/**
121+
* Constructs a RedisConfiguration object for the given properties.
122+
*/
123+
RedisConfiguration() { this = properties.getProperty("redisConfiguration") }
124+
125+
/**
126+
* Returns the 'aad-enabled' property as a StringLiteral, if present.
127+
*/
128+
StringLiteral getAadEnabled() { result = this.getProperty("aad-enabled") }
129+
130+
/** Returns the 'aad-enabled' property as a string, if present. */
131+
string aadEnabled() { result = this.getAadEnabled().getValue() }
132+
133+
/**
134+
* Returns the 'aof-backup-enabled' property as a StringLiteral, if present.
135+
*/
136+
StringLiteral getAofBackupEnabled() { result = this.getProperty("aof-backup-enabled") }
137+
138+
string aofBackupEnabled() { result = this.getAofBackupEnabled().getValue() }
139+
140+
StringLiteral getAofStorageConnectionString0() {
141+
result = this.getProperty("aof-storage-connection-string-0")
142+
}
143+
144+
string aofStorageConnectionString0() {
145+
result = this.getAofStorageConnectionString0().getValue()
146+
}
147+
148+
StringLiteral getAofStorageConnectionString1() {
149+
result = this.getProperty("aof-storage-connection-string-1")
150+
}
151+
152+
string aofStorageConnectionString1() {
153+
result = this.getAofStorageConnectionString1().getValue()
154+
}
155+
156+
StringLiteral getAuthNotRequired() { result = this.getProperty("authnotrequired") }
157+
158+
string authNotRequired() { result = this.getAuthNotRequired().getValue() }
159+
160+
StringLiteral getMaxFragmentationMemoryReserved() {
161+
result = this.getProperty("maxfragmentationmemory-reserved")
162+
}
163+
164+
string maxFragmentationMemoryReserved() {
165+
result = this.getMaxFragmentationMemoryReserved().getValue()
166+
}
167+
168+
StringLiteral getMaxMemoryDelta() { result = this.getProperty("maxmemory-delta") }
169+
170+
string maxMemoryDelta() { result = this.getMaxMemoryDelta().getValue() }
171+
172+
StringLiteral getMaxMemoryPolicy() { result = this.getProperty("maxmemory-policy") }
173+
174+
string maxMemoryPolicy() { result = this.getMaxMemoryPolicy().getValue() }
175+
176+
StringLiteral getMaxMemoryReserved() { result = this.getProperty("maxmemory-reserved") }
177+
178+
string maxMemoryReserved() { result = this.getMaxMemoryReserved().getValue() }
179+
180+
StringLiteral getNotifyKeyspaceEvents() {
181+
result = this.getProperty("notify-keyspace-events")
182+
}
183+
184+
string notifyKeyspaceEvents() { result = this.getNotifyKeyspaceEvents().getValue() }
185+
186+
StringLiteral getPreferredDataPersistenceAuthMethod() {
187+
result = this.getProperty("preferred-data-persistence-auth-method")
188+
}
189+
190+
string preferredDataPersistenceAuthMethod() {
191+
result = this.getPreferredDataPersistenceAuthMethod().getValue()
192+
}
193+
194+
StringLiteral getRdbBackupEnabled() { result = this.getProperty("rdb-backup-enabled") }
195+
196+
string rdbBackupEnabled() { result = this.getRdbBackupEnabled().getValue() }
197+
198+
StringLiteral getRdbBackupFrequency() { result = this.getProperty("rdb-backup-frequency") }
199+
200+
string rdbBackupFrequency() { result = this.getRdbBackupFrequency().getValue() }
201+
202+
StringLiteral getRdbBackupMaxSnapshotCount() {
203+
result = this.getProperty("rdb-backup-max-snapshot-count")
204+
}
205+
206+
string rdbBackupMaxSnapshotCount() { result = this.getRdbBackupMaxSnapshotCount().getValue() }
207+
208+
StringLiteral getRdbStorageConnectionString() {
209+
result = this.getProperty("rdb-storage-connection-string")
210+
}
211+
212+
string rdbStorageConnectionString() {
213+
result = this.getRdbStorageConnectionString().getValue()
214+
}
215+
216+
StringLiteral getStorageSubscriptionId() {
217+
result = this.getProperty("storage-subscription-id")
218+
}
219+
220+
string storageSubscriptionId() { result = this.getStorageSubscriptionId().getValue() }
221+
222+
string toString() { result = "RedisConfiguration" }
223+
}
224+
}
225+
}

‎ql/lib/codeql/bicep/frameworks/Microsoft/Databases.qll‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -211,21 +211,6 @@ module Databases {
211211
override string databaseType() { result = "datalakestore" }
212212
}
213213

214-
/**
215-
* Represents an Azure Cache for Redis resource.
216-
*/
217-
class RedisCaches extends DatabaseResource, Resource {
218-
/**
219-
* Constructs an instance for Azure Cache for Redis resources.
220-
*/
221-
RedisCaches() { this.getResourceType().regexpMatch("^Microsoft.Cache/Redis@.*") }
222-
223-
/**
224-
* Returns the type of the database resource ("redis").
225-
*/
226-
override string databaseType() { result = "redis" }
227-
}
228-
229214
/**
230215
* Represents an Azure Data Explorer (Kusto) cluster resource.
231216
*/

‎ql/lib/codeql/bicep/frameworks/Microsoft/General.qll‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
private import bicep
2+
3+
class Sku extends Object {
4+
private Resource resource;
5+
6+
/**
7+
* Constructs a Sku object for the given resource.
8+
*/
9+
Sku() { this = resource.getProperty("sku") }
10+
11+
/**
12+
* Returns the SKU name (e.g., Basic, Standard, Premium).
13+
*/
14+
string getName() {
15+
result = this.getProperty("name").(StringLiteral).getValue()
16+
}
17+
18+
/**
19+
* Returns the SKU tier (e.g., Basic, Standard, Premium).
20+
*/
21+
string getTier() {
22+
result = this.getProperty("tier").(StringLiteral).getValue()
23+
}
24+
25+
string toString() {
26+
result = "SKU"
27+
}
28+
}

‎ql/test/library-tests/frameworks/cache/Cache.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
cache
2+
| app.bicep:1:1:17:1 | RedisCacheResource |
3+
cacheConfig
4+
| app.bicep:1:1:17:1 | RedisCacheResource | app.bicep:13:25:15:5 | RedisConfiguration |

‎ql/test/library-tests/frameworks/cache/Cache.ql‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
import bicep
2+
3+
query predicate cache(Cache::CacheResource cache) { any() }
4+
5+
query predicate cacheConfig(
6+
Cache::RedisCacheResource cache, Cache::CacheProperties::RedisConfiguration config
7+
) {
8+
cache.getRedisConfiguration() = config
9+
}

‎ql/test/library-tests/frameworks/cache/app.bicep‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
resource redisCache 'Microsoft.Cache/Redis@2023-04-01' = {
2+
name: 'myRedisCache'
3+
location: resourceGroup().location
4+
sku: {
5+
name: 'Standard'
6+
family: 'C'
7+
capacity: 1
8+
}
9+
properties: {
10+
enableNonSslPort: false
11+
minimumTlsVersion: '1.2'
12+
publicNetworkAccess: 'Enabled'
13+
redisConfiguration: {
14+
maxmemory-policy: 'allkeys-lru'
15+
}
16+
}
17+
}

0 commit comments

Comments
 (0)