fix(googleworkspace): honor the sharing mode in Drive publishing check (#13115)

prowler/changelog.d/googleworkspace-drive-publishing-mode.fixed.md

@@ -0,0 +1 @@
+Google Workspace `drive_publishing_files_disabled` passes when sharing outside the organization is limited to allowlisted domains or off, since publishing to the web only exists with sharing on

prowler/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled.metadata.json

@@ -37,5 +37,5 @@
     "drive_sharing_allowlisted_domains",
     "drive_internal_users_distribute_content"
   ],
-  "Notes": ""
+  "Notes": "The publishing option only applies when sharing outside of the organization is ON. With Allowlisted domains or OFF, Google hides it and nothing can be made visible to anyone with the link, so the check passes regardless of the stored flag."
 }

prowler/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled.py

@@ -10,7 +10,10 @@ class drive_publishing_files_disabled(Check):
     This check verifies that the domain-level Drive and Docs policy prevents
     users from publishing files to the web or making them visible to anyone
     with the link, blocking unintended public exposure of organizational
-    content.
+    content. The publishing option only exists when sharing outside of the
+    organization is ON: with allowlisted domains or sharing OFF, Google hides
+    it and nothing can be made visible to anyone with the link, whatever
+    value the API still stores for the flag.
     """
 
     def execute(self) -> List[CheckReportGoogleWorkspace]:
@@ -26,8 +29,23 @@ class drive_publishing_files_disabled(Check):
             )
 
             allow_publishing = drive_client.policies.allow_publishing_files
+            sharing_mode = drive_client.policies.external_sharing_mode
 
-            if allow_publishing is False:
+            if sharing_mode == "ALLOWLISTED_DOMAINS":
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Publishing files to the web is not possible in domain "
+                    f"{drive_client.provider.identity.domain}: sharing outside of "
+                    f"the organization is limited to allowlisted domains."
+                )
+            elif sharing_mode == "DISALLOWED":
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Publishing files to the web is not possible in domain "
+                    f"{drive_client.provider.identity.domain}: sharing outside of "
+                    f"the organization is off."
+                )
+            elif allow_publishing is False:
                 report.status = "PASS"
                 report.status_extended = (
                     f"Publishing files to the web is disabled in domain "

tests/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled_test.py

@@ -3,6 +3,7 @@ from unittest.mock import patch
 from prowler.providers.googleworkspace.services.drive.drive_service import DrivePolicies
 from tests.providers.googleworkspace.googleworkspace_fixtures import (
     CUSTOMER_ID,
+    DOMAIN,
     set_mocked_googleworkspace_provider,
 )
 
@@ -38,6 +39,106 @@ class TestDrivePublishingFilesDisabled:
             assert findings[0].resource_name == "Drive Policies"
             assert findings[0].customer_id == CUSTOMER_ID
 
+    def test_pass_when_external_sharing_is_limited_to_allowlisted_domains(self):
+        """The publishing flag only applies when sharing outside the organization is ON.
+
+        Under "Allowlisted domains" the Admin console hides the option and
+        nothing can be made visible to anyone with the link, whatever value
+        the API still stores for the flag.
+        """
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.drive.drive_publishing_files_disabled.drive_publishing_files_disabled.drive_client"
+            ) as mock_drive_client,
+        ):
+            from prowler.providers.googleworkspace.services.drive.drive_publishing_files_disabled.drive_publishing_files_disabled import (
+                drive_publishing_files_disabled,
+            )
+
+            mock_drive_client.provider = mock_provider
+            mock_drive_client.policies_fetched = True
+            mock_drive_client.policies = DrivePolicies(
+                external_sharing_mode="ALLOWLISTED_DOMAINS",
+                allow_publishing_files=True,
+            )
+
+            findings = drive_publishing_files_disabled().execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "PASS"
+            assert findings[0].status_extended == (
+                f"Publishing files to the web is not possible in domain {DOMAIN}: "
+                f"sharing outside of the organization is limited to allowlisted "
+                f"domains."
+            )
+
+    def test_pass_when_external_sharing_is_off(self):
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.drive.drive_publishing_files_disabled.drive_publishing_files_disabled.drive_client"
+            ) as mock_drive_client,
+        ):
+            from prowler.providers.googleworkspace.services.drive.drive_publishing_files_disabled.drive_publishing_files_disabled import (
+                drive_publishing_files_disabled,
+            )
+
+            mock_drive_client.provider = mock_provider
+            mock_drive_client.policies_fetched = True
+            mock_drive_client.policies = DrivePolicies(
+                external_sharing_mode="DISALLOWED",
+                allow_publishing_files=None,
+            )
+
+            findings = drive_publishing_files_disabled().execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "PASS"
+            assert findings[0].status_extended == (
+                f"Publishing files to the web is not possible in domain {DOMAIN}: "
+                f"sharing outside of the organization is off."
+            )
+
+    def test_fail_when_external_sharing_is_on_and_publishing_is_allowed(self):
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.drive.drive_publishing_files_disabled.drive_publishing_files_disabled.drive_client"
+            ) as mock_drive_client,
+        ):
+            from prowler.providers.googleworkspace.services.drive.drive_publishing_files_disabled.drive_publishing_files_disabled import (
+                drive_publishing_files_disabled,
+            )
+
+            mock_drive_client.provider = mock_provider
+            mock_drive_client.policies_fetched = True
+            mock_drive_client.policies = DrivePolicies(
+                external_sharing_mode="ALLOWED",
+                allow_publishing_files=True,
+            )
+
+            findings = drive_publishing_files_disabled().execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "enabled" in findings[0].status_extended
+
     def test_fail_publishing_enabled(self):
         """Test FAIL when publishing files to web is enabled"""
         mock_provider = set_mocked_googleworkspace_provider()