Cover unguarded direct datastore access with unit tests

Threagile · Jun 4, 2024 · 87b4108 · 87b4108
1 parent 6c3cdd9
commit 87b4108
Show file tree

Hide file tree

Showing 2 changed files with 416 additions and 2 deletions.
diff --git a/pkg/security/risks/builtin/unguarded_direct_datastore_access_rule.go b/pkg/security/risks/builtin/unguarded_direct_datastore_access_rule.go
@@ -53,9 +53,12 @@ func (r *UnguardedDirectDatastoreAccessRule) GenerateRisks(input *types.Model) (
 					continue
 				}
 
+				acrossTrustBoundaryNetworkOnly := incomingAccess.IsAcrossTrustBoundaryNetworkOnly(input)
+				sharingSameParentTrustBoundary := isSharingSameParentTrustBoundary(input, technicalAsset, sourceAsset)
+
 				if technicalAsset.Confidentiality >= types.Confidential || technicalAsset.Integrity >= types.Critical {
-					if incomingAccess.IsAcrossTrustBoundaryNetworkOnly(input) && !fileServerAccessViaFTP(technicalAsset, incomingAccess) &&
-						incomingAccess.Usage != types.DevOps && !isSharingSameParentTrustBoundary(input, technicalAsset, sourceAsset) {
+					if acrossTrustBoundaryNetworkOnly && !fileServerAccessViaFTP(technicalAsset, incomingAccess) &&
+						incomingAccess.Usage != types.DevOps && !sharingSameParentTrustBoundary {
 						highRisk := technicalAsset.Confidentiality == types.StrictlyConfidential ||
 							technicalAsset.Integrity == types.MissionCritical
 						risks = append(risks, r.createRisk(technicalAsset, incomingAccess,