Security fixes: cryptography CVE-2026-69247 and other dependency patches - #227
Merged
Conversation
… compliance mappings, docs
* feat: add sentinel/ingest.py — Log Analytics ingestion via HMAC-SHA256 * feat: add sentinel/__init__.py * feat: add KQL rule — HIGH severity finding detected * feat: add KQL rule — misconfiguration wave detection * feat: add KQL rule — new resource type critical detection * Delete sentinel/rules directory * Create rules * Delete sentinel/rules * Add KQL rule for high severity findings * Add Misconfiguration Wave detection rule * Add KQL rule for persistent misconfiguration detection * Add KQL rule for new critical resource types This rule identifies new resource types with critical findings that have occurred in the last 24 hours, excluding known types from the last 30 days. * Add script to generate test findings in JSON format This script generates test findings related to security compliance and saves them in a JSON file. * Add Sentinel integration test plan and results Added a comprehensive test plan for Sentinel integration, detailing test objectives, results, and acceptance criteria for various KQL rules and data ingestion. * docs: add sentinel integration setup guide Added a comprehensive setup guide for integrating Sentinel with Azure, covering prerequisites, workspace creation, activation, environment variable setup, ingestion, log verification, KQL rules deployment, and incident verification.
* Add az_net_003.py to check NSG rules for port 443 This script detects Network Security Groups (NSGs) with unrestricted inbound access on port 443 and provides remediation guidance. * Add AZ-NET-004 rule for empty NSG detection This script detects Network Security Groups (NSGs) that have no custom security rules configured, providing details for remediation. * Add AZ-NET-005 rule for DDoS protection check This script detects virtual networks in Azure that do not have DDoS protection enabled and provides remediation steps. * feat: add rule AZ-NET-006 — public IP unassociated with any resource This rule detects public IP addresses that are not associated with any resource, providing details for remediation. * feat: add rule AZ-NET-007 — Application Gateway without WAF enabled This rule detects Application Gateways that do not have WAF enabled, logging findings and providing remediation steps. * feat: add rule AZ-NET-008 — load balancer with no backend pool This rule detects load balancers in Azure that are not configured with a backend pool, indicating potential misconfiguration or unnecessary costs. * feat: add rule AZ-NET-009 — VPN gateway using outdated IKE version This script detects VPN gateways using the outdated IKEv1 protocol and provides remediation steps to migrate to IKEv2. * feat: add rule AZ-NET-010 — subnet with no NSG attached This script detects subnets in Azure that do not have a Network Security Group (NSG) attached, logging findings and providing remediation guidance. * feat: add playbook fix_az_net_003.sh This script updates the NSG rule to restrict inbound traffic on port 443 to a specified IP range. * feat: add playbook fix_az_net_004.sh This script adds a default deny-all inbound rule to a specified NSG. * feat: add playbook fix_az_net_005.sh This script enables DDoS protection on a specified virtual network in Azure. It checks for required parameters and provides usage instructions if they are missing. * feat: add playbook fix_az_net_006.sh This script deletes unassociated public IP addresses in Azure. * feat: add playbook fix_az_net_007.sh This script enables WAF on an Application Gateway, ensuring compliance with the AZ-NET-007 rule. * feat: add playbook fix_az_net_008.sh Script to remediate AZ-NET-008 by deleting empty load balancers. * feat:add script to update VPN connection to IKEv2 This script updates a VPN connection to use IKEv2, ensuring compliance with the AZ-NET-009 rule. * feat: add playbook fix_az_net_010.sh This script attaches a specified network security group to a given subnet in a virtual network, ensuring compliance with the AZ-NET-010 rule. * Clarify description and add note for public-facing services Updated the description to clarify the risk of exposing port 443 and added a note regarding public-facing services. * Change severity level from MEDIUM to HIGH * fix: AZ-NET-005 severity changed to LOW — DDoS Standard high cost on small subscriptions * Add note about NetworkManagementClient usage Added a note regarding the creation of NetworkManagementClient directly and suggested a follow-up for consistency. * Add note about NetworkManagementClient usage Added a note regarding the use of NetworkManagementClient and suggested a follow-up for consistency. * Add additional security controls to CIS Azure benchmark * Refine control descriptions in nist_csf.json Updated descriptions for various controls to enhance clarity and specificity regarding remote access management, data protection, and security measures. * fix: add AZ-NET-003 to AZ-NET-010 to ISO27001 compliance framework Updated descriptions for various controls to clarify compliance requirements and improve security guidance. --------- Co-authored-by: Vishnu Ajith <86302373+Vishnu2707@users.noreply.github.com>
* feat: add rule AZ-STOR-003 storage lifecycle policy check * feat: add rule AZ-STOR-003 storage lifecycle policy check
* docs: add SOC 2 Type II compliance framework mapping for all 20 rules Added SOC 2 Type II framework with detailed controls for security measures and compliance requirements. * feat: add soc2 to FRAMEWORK_FILE_MAP in finding.py add soc2.json to FRAMEWORK_FILE_MAP in finding.py * feat: add soc2 to SUPPORTED_FRAMEWORKS in compliance.py Added 'soc2' to the list of supported compliance frameworks. * Add SOC 2 controls for data protection and management
* refactor: add get_virtual_networks() and get_public_ip_addresses() to AzureClient * Refactor DDoS protection check to use azure_client * refactor: AZ-NET-006 now uses azure_client.get_public_ip_addresses()
- Python syntax check on all rule files - Rule structure validation (RULE_ID, SEVERITY, FRAMEWORKS) + RULE_ID uniqueness - Hardcoded credential scan - Playbook existence + bash syntax check for every rule - Compliance JSON validation for all four framework files (inc. soc2.json) - API syntax check - Compliance vs rule cross-reference check - CI summary step with per-check pass/fail table (if: always) - Fix duplicate DESCRIPTION assignment in az_net_003.py - Add pyyaml to requirements.txt for local YAML validation - Add docs/ci-pipeline.md with local run commands and design rationale - Update CI_PIPELINE_GUIDE.md with final PR description Closes #30
…amework mappings, HNDL exposure window and migration roadmap (#187) Signed-off-by: Vishnu Ajith <27vishnu07@gmail.com>
* feat(scanner): add enterprise AKS security rule pack * style(scanner): format AKS rules * ci: document AKS SDK license exception
Two residual issues from #183's merge, found in post-merge review: - toEmbedUrl() validated the host via new URL() but returned the raw input, so an attribute-injection payload on an allowed host (e.g. https://www.youtube.com/embed/abc" onload="alert(1)) passed validation and kept its literal double-quote, breaking out of the iframe src="..." attribute. Now returns parsed.href, which percent-encodes quotes, spaces, and brackets. - The switch to in-memory key storage removed the localStorage write but never purged keys that older builds had already stored, so existing users kept a plaintext ai_api_key indefinitely. Added a one-time purge on module load (not read into memory) and in clear(). Both fixes ship with regression tests confirmed to fail against the pre-fix code and pass against the fix. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
… badge compliance (#190)
* Add Semgrep SAST to CI alongside CodeQL * Add non-root USER to Dockerfile to satisfy Semgrep gate * Document Dockerfile hardening intent and Semgrep registry dependency * Remove issue reference from Dockerfile comment
…163) * fix(scanner): resolve COR-001-004 scanner correctness issues (#151) * fix(scanner): normalise Azure SDK enum fields in AZ-NET-003 and AZ-DB-002 Addresses review feedback on PR #163: - Add a shared enum_str() helper in azure_client.py that safely unwraps Azure SDK enum fields via .value, since str(enum_member) yields e.g. 'SecurityRuleDirection.INBOUND' rather than 'Inbound' and silently breaks naive string comparisons against real SDK objects. - AZ-NET-003: normalise direction, access, and source_address_prefix through enum_str() so real SecurityRuleDirection/SecurityRuleAccess enum values are detected correctly, not just plain-string mocks. - AZ-DB-002: normalise the auditing policy state through enum_str() so a real BlobAuditingPolicyState.ENABLED value is not mistaken for disabled (false positive) or vice versa. - AZ-DB-002: malformed ARM IDs are now logged explicitly instead of silently skipped. - AZ-NET-003: the matched plural source_address_prefixes entry is now included in finding metadata. - Add regression tests using real azure-mgmt-network / azure-mgmt-sql SDK model classes (SecurityRule, SecurityRuleDirection, SecurityRuleAccess, ServerBlobAuditingPolicy, BlobAuditingPolicyState) rather than only SimpleNamespace/string-backed mocks, per SHAURYAKSHARMA24's review. - Sync branch with upstream dev (v0.3.0) and apply current ruff format gate, per ritiksah141's review. * fix: remove duplicate _diagnostic_settings init line --------- Co-authored-by: safidnadaf <safidnadaf@users.noreply.github.com>
…ules (#197) * feat(scanner): add enterprise identity security pack * docs(compliance): use numbered TBD identity placeholders
* docs: prepare OpenSSF Silver readiness evidence * feat(frontend): add accessibility and i18n foundations --------- Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com>
* fix: resolve all open security alerts (8 Dependabot + 1 CodeQL) Closes #221. Dependency vulnerabilities: - react-router-dom (root and frontend) replaced with react-router 8.3.0. react-router v8 dropped the react-router-dom re-export package, so this is an import migration, not just a version bump: all 9 files that imported from react-router-dom (BrowserRouter, Routes, Route, Navigate, useLocation, useNavigate, NavLink, Outlet) now import from react-router directly, matching v8's actual export surface (react-router/dom only ships RouterProvider/HydratedRouter, which nothing here uses). Fixes Dependabot alerts #12, #10, #8, #7, #6, #5. - postcss bumped to 8.5.18+ (resolved to 8.5.25). Fixes alert #9. - brace-expansion bumped to 5.0.9 via npm audit fix, clearing both the originally reported alert #4 (exponential-time expansion DoS) and a second advisory affecting versions up to and including 5.0.7 (out-of-memory DoS) that the requested 5.0.7 floor would not have cleared on its own. CodeQL alert #31 (py/clear-text-logging-sensitive-data): - scanner/rules/az_idn_006.py logged the raw endDateTime value from a service principal's password credential when it failed to parse. Drops the value from the log line entirely; app_id alone is sufficient to correlate the failure. Matches the fix already proposed in draft PR #220, which this supersedes. - Strengthened the existing regression test to also assert the malformed endDateTime value itself never reaches the logs (it previously only checked keyId), and verified the test fails against the pre-fix code before restoring the fix. Added node_modules/ to the root .gitignore - the root package.json exists only to give Dependabot a manifest to track react-router against, but running npm install there to regenerate its lockfile was leaving an untracked node_modules/ with nothing preventing it from being committed. Verified: npm audit clean (root and frontend, 0 vulnerabilities each), frontend build and lint pass, ruff check/format clean, full pytest suite passes (437 passed, 2 pre-existing failures unrelated to this change - local chromadb version mismatch, not present in CI). Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com> * style: fix ruff format drift on markdown-embedded Python examples CI's ruff (unpinned) reformatted the embedded code fences in CONTRIBUTING.md, docs/adding-a-rule.md, and docs/architecture.md again since the last fix in b9d4538 - whitespace only, no content changes. Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com> * fix: declare react-router 8.3.0's runtime requirements per review react-router@8.3.0 requires Node >=22.22.0 and react/react-dom >=19.2.7 (peer deps). Bump the declared React floors, add an engines.node field to frontend/package.json, and pin CI's frontend job to Node 22.22.0 so the requirement is enforced rather than relying on "latest 22.x" happening to be new enough. Addresses ritiksah141's CHANGES_REQUESTED review on PR #222. Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com> --------- Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com>
* feat(scanner): add Supply Chain security pack (AZ-SC-001..008) Closes the gap identified in #213: OpenShield had zero rules covering OWASP Top 10:2025's A03 Software Supply Chain Failures category, the highest-incidence category (5.72%) and one enterprise CSPM vendors treat as core coverage. Container Registry hardening (#214): - AZ-SC-001: admin user enabled - AZ-SC-002: public network access enabled - AZ-SC-003: anonymous pull enabled - AZ-SC-004: missing retention/quarantine policy New dependency: azure-mgmt-containerregistry. Terraform/IaC state exposure (#214): - AZ-SC-005: state container publicly readable - AZ-SC-006: state storage account missing versioning/soft delete Reuses the existing azure-mgmt-storage dependency at the per-container level via new AzureClient.get_blob_containers() and get_blob_service_properties() accessors. Azure DevOps pipeline scanning (#215, #216, #217): - New scanner/devops_client.py, reusing the existing service principal credential scoped to Azure DevOps' well-known resource ID rather than a separate stored credential (e.g. a PAT). - AzureClient.devops_client is None when AZURE_DEVOPS_ORG_URL / AZURE_DEVOPS_PROJECT are not configured; the two rules below treat that as not applicable, not an indeterminate failure. - AZ-SC-007: service connection scoped to subscription and shared across every pipeline - AZ-SC-008: service connection uses a stored secret instead of workload identity federation New dependency: azure-devops. All 8 rules are added to all four compliance framework JSONs (CIS, NIST CSF, ISO 27001, SOC 2) with matching control IDs, per the pattern established after PR #198's review. Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com> * style: fix ruff format on markdown-embedded Python code blocks CI's ruff (installed fresh, unpinned) is newer than the local dev environment's and now reformats Python code fences inside markdown files. Reformats the embedded examples in CONTRIBUTING.md, docs/adding-a-rule.md, and docs/architecture.md - whitespace only, no content changes. Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com> * fix: correct three real logic bugs found in self-review AZ-SC-004: quarantine is a Premium-tier-only ACR feature, but the rule required it on every registry regardless of SKU. Every Basic/Standard registry (the common tier) would permanently fail this check even when correctly hardened for its tier. Now only requires quarantine on Premium registries; retention is still required on all tiers. AZ-SC-007: is_shared means shared with other projects per the Azure DevOps SDK docs, not shared across every pipeline in this project as the rule claimed. Renamed to drop the and Shared framing and flag subscription-scoped connections on their scope alone, which is itself a real, sufficient finding regardless of is_shared. AZ-SC-008: the federated-scheme allowlist only included WorkloadIdentityFederation, missing ManagedServiceIdentity, a second, equally secretless authentication scheme. Service connections using managed identity auth were being incorrectly flagged as using a stored secret. Adds regression tests proving each fix, and updates the two rules compliance framework JSON entries and docs/rules-reference.md to match. Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com> --------- Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com>
* governance: enforce DCO and document continuity checks Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com> * fix: exclude merge commits from the DCO sign-off check commits_between() checked every commit in the PR range including merge commits, which carry Git's own default message and no Signed-off-by trailer since they aren't the author's own work. This would have hard-failed the DCO gate on legitimate `git merge origin/dev` commits (e.g. the two that landed in #161's review cycle) through no fault of the contributor's own commits — GitHub's own DCO app skips merge commits for the same reason. Add --no-merges to the rev-list call and document the exemption in docs/dco.md so contributors know only their own commits need signing. Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com> --------- Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com>
Signed-off-by: ritiksah141 <ritiksah141@gmail.com>
Vishnu2707
requested review from
SHAURYAKSHARMA24,
TFT444,
parthrohit22 and
vogonPrayas
as code owners
August 5, 2026 10:53
Dependency ReviewThe following issues were found:
License Issuesfrontend/package.json
requirements.txt
OpenSSF ScorecardScorecard details
Scanned Files
|
ritiksah141
approved these changes
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Merges dev into main to release accumulated security fixes, including the cryptography CVE-2026-69247 patch (Bleichenbacher oracle in PKCS#7 decryption, fixed by bumping to 50.0.0) and other pending dependency updates from dev.
Type of change
Testing
Related issue
Closes #225