Azure / template-analyzer

Template scanner for security misconfiguration and best practices
MIT License
130 stars 38 forks source link

[BUG] Nested template in ARM template gives wrong line number when referenced as Bicep module #307

Open nonik0 opened 2 years ago

nonik0 commented 2 years ago

Describe the bug

When an ARM template with a nested template is referenced from a Bicep template as a module, any results from the nested ARM template will have incorrect line numbers.

Expected behavior

Template-Analyzer should be able to give correct line numbers for results in nested ARM templates that are referenced from Bicep templates.

Reproduction Steps

  1. Create an ARM template that has a nested template, e.g. use one from tests like SimpleNestedFail.json.
  2. Create a Bicep module that references the ARM template with a nested template, e.g.
    module armTemplate './{armTemplateFileName}' = {
    name: 'nestedTemplate'
    scope: resourceGroup('my-rg')
    params: {}
    }
  3. Scan with template-analyzer and verify that line numbers for specific results in nested ARM template are incorrect.

Environment

No response

nonik0 commented 2 years ago

In order to fix this issue, the tool will need to recreate a populated TemplateContext that reflects what JsonSourceLocationResolver would have when processing a nested template, complete with the JObjects of the extracted nested templates, etc. Will likely need to refactor the nested template processing code in AnalyzeAllIncludedTemplates in a shared class that TemplateAnalyzer and BicepLocationProcessor can used to process a nested ARM template.

Additionally, BicepLocationResolver needs to use a TemplateContext to match the context of the nested template, so there will need to be a way to determine what nested template is in scope from the JSON path as well before resolving the line number.