feat(query): Add TLS Disabled query

Author: GeekMasher

ql/lib/codeql/bicep/Concepts.qll

@@ -12,6 +12,10 @@ abstract class PublicResource extends Resource {
 }
 
 module Cryptography {
+  abstract class TlsDisabled extends Resource {
+    abstract boolean isTlsDisabled();
+  }
+
   abstract class WeakTlsVersion extends Resource {
     abstract StringLiteral getWeakTlsVersionProperty();
 

ql/lib/codeql/bicep/frameworks/Microsoft/Cache.qll

@@ -76,6 +76,18 @@ module Cache {
     }
   }
 
+  class RedisCacheTlsDisabled extends RedisCacheResource, Cryptography::TlsDisabled {
+    override boolean isTlsDisabled() {
+      exists(boolean tlsPortDisabled | tlsPortDisabled = this.enableNonSslPort() |
+        tlsPortDisabled = true and
+        result = false
+        or
+        tlsPortDisabled = false and
+        result = true
+      )
+    }
+  }
+
   module CacheProperties {
     /**
      * Represents the properties object for a Redis cache resource.

ql/test/queries-tests/security/CWE-327/TlsDisabled/TlsDisabled.expected

@@ -0,0 +1,2 @@
+| app.bicep:12:1:19:1 | RedisCacheResource | TLS is disabled for this resource |
+| app.bicep:22:1:29:1 | RedisCacheResource | TLS is disabled for this resource |

ql/test/queries-tests/security/CWE-327/TlsDisabled/TlsDisabled.qlref

@@ -0,0 +1 @@
+security/CWE-327/TlsDisabled.ql

ql/test/queries-tests/security/CWE-327/TlsDisabled/app.bicep

@@ -0,0 +1,29 @@
+// Bicep sample with TLS disabled for testing
+// Case 1: enableNonSslPort not set (should be secure)
+resource redis1 'Microsoft.Cache/Redis@2021-06-01' = {
+  name: 'redis1'
+  location: 'eastus'
+  properties: {
+    publicNetworkAccess: 'Enabled'
+  }
+}
+
+// Case 2: enableNonSslPort enabled (TLS disabled, should trigger)
+resource redis2 'Microsoft.Cache/Redis@2021-06-01' = {
+  name: 'redis2'
+  location: 'eastus'
+  properties: {
+    enableNonSslPort: true
+    publicNetworkAccess: 'Enabled'
+  }
+}
+
+// Case 3: enableNonSslPort disabled (TLS enforced, should be secure)
+resource redis3 'Microsoft.Cache/Redis@2021-06-01' = {
+  name: 'redis3'
+  location: 'eastus'
+  properties: {
+    enableNonSslPort: false
+    publicNetworkAccess: 'Enabled'
+  }
+}