Skip to content

Commit fe8785d

Browse files
GeekMasherGeekMasher
committed
feat: Add initial Containers support
1 parent eb8fb26 commit fe8785d

File tree

3 files changed

+228
-28
lines changed

3 files changed

+228
-28
lines changed

‎ql/lib/codeql/bicep/Frameworks.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import frameworks.Microsoft.Cache
22
import frameworks.Microsoft.Compute
3+
import frameworks.Microsoft.Containers
34
import frameworks.Microsoft.General
45
import frameworks.Microsoft.Network
56
import frameworks.Microsoft.Storage

‎ql/lib/codeql/bicep/frameworks/Microsoft/Containers.qll‎

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
private import bicep
2+
3+
module Containers {
4+
/**
5+
* Represents a Microsoft.ContainerApp/containerApps resource.
6+
* See: https://learn.microsoft.com/en-us/azure/templates/microsoft.app/containerapps
7+
*/
8+
class ContainerResource extends Resource {
9+
/**
10+
* Constructs a ContainerResource for Microsoft.App/containerApps resources.
11+
*/
12+
ContainerResource() { this.getResourceType().regexpMatch("^Microsoft.App/containerApps@.*") }
13+
14+
/**
15+
* Returns the properties object for the container app resource.
16+
*/
17+
ContainerProperties::Properties getProperties() { result = this.getProperty("properties") }
18+
19+
ContainerProperties::ContainerConfiguration getConfiguration() {
20+
result = this.getProperties().getConfiguration()
21+
}
22+
23+
ContainerProperties::ContainerTemplate getTemplate() {
24+
result = this.getProperties().getTemplate()
25+
}
26+
27+
ContainerProperties::ContainerApp getContainers() {
28+
result = this.getTemplate().getContainers()
29+
}
30+
31+
ContainerProperties::ContainerApp getContainer(int index) {
32+
result = this.getTemplate().getContainer(index)
33+
}
34+
35+
/**
36+
* Returns a string representation of the container app resource.
37+
*/
38+
override string toString() { result = "ContainerResource" }
39+
}
40+
41+
module ContainerProperties {
42+
/**
43+
* Represents the properties object for a container app resource.
44+
*/
45+
class Properties extends Object {
46+
private ContainerResource containerResource;
47+
48+
/**
49+
* Constructs a Properties object for the given container app resource.
50+
*/
51+
Properties() { this = containerResource.getProperty("properties") }
52+
53+
/**
54+
* Returns the parent ContainerResource.
55+
*/
56+
ContainerResource getContainerResource() { result = containerResource }
57+
58+
/**
59+
* Returns the configuration property.
60+
*/
61+
ContainerConfiguration getConfiguration() { result = this.getProperty("configuration") }
62+
63+
ContainerTemplate getTemplate() { result = this.getProperty("template") }
64+
65+
string toString() { result = "ContainerProperties" }
66+
}
67+
68+
class ContainerConfiguration extends Object {
69+
private Properties properties;
70+
71+
/**
72+
* Constructs a Configuration object for the given properties.
73+
*/
74+
ContainerConfiguration() { this = properties.getProperty("configuration") }
75+
76+
Network::Ingress getNetworkIngress() { result = this.getProperty("ingress") }
77+
78+
ContainerSecret getSecrets() { result = this.getProperty("secrets").(Array).getElements() }
79+
80+
StringLiteral getActiveRevisionsMode() { result = this.getProperty("activeRevisionsMode") }
81+
82+
string activeRevisionsMode() { result = this.getActiveRevisionsMode().getValue() }
83+
84+
/**
85+
* Returns the template property.
86+
*/
87+
Expr getTemplate() { result = this.getProperty("template") }
88+
89+
string toString() { result = "ContainerConfiguration" }
90+
}
91+
92+
class ContainerSecret extends Object {
93+
private ContainerConfiguration configuration;
94+
95+
/**
96+
* Constructs a ContainerSecret for the given configuration.
97+
*/
98+
ContainerSecret() { this = configuration.getProperty("secrets").(Array).getElements() }
99+
100+
/**
101+
* Returns the name of the secret.
102+
*/
103+
StringLiteral getName() { result = this.getProperty("name") }
104+
105+
/**
106+
* Returns the value of the secret.
107+
*/
108+
StringLiteral getValue() { result = this.getProperty("value") }
109+
110+
string toString() { result = "ContainerSecret" }
111+
}
112+
113+
class ContainerTemplate extends Object {
114+
private Properties properties;
115+
116+
/**
117+
* Constructs a ContainerTemplate for the given properties.
118+
*/
119+
ContainerTemplate() { this = properties.getProperty("template") }
120+
121+
/**
122+
* Returns the container app template.
123+
*/
124+
Expr getContainerAppTemplate() { result = this.getProperty("containerAppTemplate") }
125+
126+
/**
127+
* Returns the container app template's containers.
128+
*/
129+
ContainerApp getContainers() { result = this.getProperty("containers").(Array).getElements() }
130+
131+
ContainerApp getContainer(int index) {
132+
result = this.getProperty("containers").(Array).getElement(index)
133+
}
134+
135+
string toString() { result = "ContainerTemplate" }
136+
}
137+
138+
class ContainerApp extends Object {
139+
private ContainerTemplate template;
140+
141+
ContainerApp() { this = template.getProperty("containers").(Array).getElements() }
142+
143+
ContainerTemplate getContainerTemplate() { result = template }
144+
145+
StringLiteral getName() { result = this.getProperty("name") }
146+
147+
StringLiteral getImage() { result = this.getProperty("image") }
148+
149+
ContainerResources getResources() { result = this.getProperty("resources") }
150+
151+
ContainerEnv getEnvs() { result = this.getProperty("env").(Array).getElements() }
152+
153+
ContainerEnv getEnv(string name) {
154+
exists(ContainerEnv env |
155+
env = this.getEnvs() and
156+
env.getName().getValue() = name
157+
|
158+
result = env
159+
)
160+
}
161+
162+
string toString() { result = "ContainerProperty" }
163+
}
164+
165+
class ContainerResources extends Object {
166+
private ContainerApp container;
167+
168+
ContainerResources() { this = container.getProperty("resources") }
169+
170+
/**
171+
* Returns the properties object for the container resource.
172+
*/
173+
ContainerProperties::Properties getContainerProperties() {
174+
result = this.getProperty("properties")
175+
}
176+
177+
Literals getCpu() { result = this.getProperty("cpu") }
178+
179+
StringLiteral getMemory() { result = this.getProperty("memory") }
180+
181+
string toString() { result = "ContainerResourceProperties" }
182+
}
183+
184+
class ContainerEnv extends Object {
185+
private ContainerApp container;
186+
187+
ContainerEnv() { this = container.getProperty("env").(Array).getElements() }
188+
189+
ContainerApp getContainer() { result = container }
190+
191+
StringLiteral getName() { result = this.getProperty("name") }
192+
193+
StringLiteral getValue() { result = this.getProperty("value") }
194+
195+
string toString() { result = "ContainerEnv" }
196+
}
197+
}
198+
}

‎ql/lib/codeql/bicep/frameworks/Microsoft/Network.qll‎

Lines changed: 29 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,6 @@ module Network {
112112
}
113113
}
114114

115-
116115
class NetworkAcl extends Object {
117116
private Resource resource;
118117

@@ -125,47 +124,49 @@ module Network {
125124

126125
Resource getResource() { result = resource }
127126

128-
StringLiteral getBypass() {
129-
result = this.getProperty("bypass")
130-
}
127+
StringLiteral getBypass() { result = this.getProperty("bypass") }
131128

132-
string bypass() {
133-
result = this.getBypass().getValue()
134-
}
129+
string bypass() { result = this.getBypass().getValue() }
135130

136-
StringLiteral getDefaultAction() {
137-
result = this.getProperty("defaultAction")
138-
}
131+
StringLiteral getDefaultAction() { result = this.getProperty("defaultAction") }
139132

140-
string defaultAction() {
141-
result = this.getDefaultAction().getValue()
142-
}
133+
string defaultAction() { result = this.getDefaultAction().getValue() }
143134

144-
IpRule getIpRules() {
145-
result = this.getProperty("ipRules").(Array).getElements()
146-
}
135+
IpRule getIpRules() { result = this.getProperty("ipRules").(Array).getElements() }
147136

148-
string toString() {
149-
result = "Network ACL"
150-
}
137+
string toString() { result = "Network ACL" }
151138
}
152139

153140
class IpRule extends Object {
154141
private NetworkAcl acl;
155142

156-
IpRule() {
157-
this = acl.getProperty("ipRules").(Array).getElements()
158-
}
143+
IpRule() { this = acl.getProperty("ipRules").(Array).getElements() }
159144

160145
NetworkAcl getNetworkAcl() { result = acl }
161146

162-
StringLiteral getValue() {
163-
result = this.getProperty("value")
164-
}
147+
StringLiteral getValue() { result = this.getProperty("value") }
165148

166-
string toString() {
167-
result = "IP Rule"
168-
}
149+
string toString() { result = "IP Rule" }
150+
}
151+
152+
class Ingress extends Object {
153+
private Object properties;
154+
155+
Ingress() { this = properties.getProperty("ingress") }
156+
157+
Boolean getExternal() { result = this.getProperty("external") }
158+
159+
boolean external() { result = this.getExternal().(Boolean).getBool() }
160+
161+
Number getTargetPort() { result = this.getProperty("targetPort") }
162+
163+
int targetPort() { result = this.getTargetPort().getValue() }
164+
165+
StringLiteral getTransport() { result = this.getProperty("transport") }
166+
167+
string transport() { result = this.getTransport().getValue() }
168+
169+
string toString() { result = "NetworkIngress" }
169170
}
170171

171172
module VirtualNetworkProperties {

0 commit comments

Comments
 (0)