From 02c888137803c9bae2442f44765cbbde0098fc6a Mon Sep 17 00:00:00 2001 From: Pepe Fagoaga Date: Thu, 22 Oct 2026 01:11:14 +0200 Subject: [PATCH] fix(googleworkspace): honor the sharing mode in Drive publishing check (#13115) --- ...leworkspace-drive-publishing-mode.fixed.md | 1 + ...ve_publishing_files_disabled.metadata.json | 2 +- .../drive_publishing_files_disabled.py | 22 +++- .../drive_publishing_files_disabled_test.py | 101 ++++++++++++++++++ 4 files changed, 123 insertions(+), 3 deletions(-) create mode 100644 prowler/changelog.d/googleworkspace-drive-publishing-mode.fixed.md diff --git a/prowler/changelog.d/googleworkspace-drive-publishing-mode.fixed.md b/prowler/changelog.d/googleworkspace-drive-publishing-mode.fixed.md new file mode 100644 index 0000000000..0dfc6acff2 --- /dev/null +++ b/prowler/changelog.d/googleworkspace-drive-publishing-mode.fixed.md @@ -0,0 +1 @@ +Google Workspace `drive_publishing_files_disabled` passes when sharing outside the organization is limited to allowlisted domains or off, since publishing to the web only exists with sharing on diff --git a/prowler/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled.metadata.json b/prowler/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled.metadata.json index 323d7f07a1..7d549895bb 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled.metadata.json +++ b/prowler/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled.metadata.json @@ -37,5 +37,5 @@ "drive_sharing_allowlisted_domains", "drive_internal_users_distribute_content" ], - "Notes": "" + "Notes": "The publishing option only applies when sharing outside of the organization is ON. With Allowlisted domains or OFF, Google hides it and nothing can be made visible to anyone with the link, so the check passes regardless of the stored flag." } diff --git a/prowler/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled.py b/prowler/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled.py index 397f1eee68..4bc2c5be05 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled.py +++ b/prowler/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled.py @@ -10,7 +10,10 @@ class drive_publishing_files_disabled(Check): This check verifies that the domain-level Drive and Docs policy prevents users from publishing files to the web or making them visible to anyone with the link, blocking unintended public exposure of organizational - content. + content. The publishing option only exists when sharing outside of the + organization is ON: with allowlisted domains or sharing OFF, Google hides + it and nothing can be made visible to anyone with the link, whatever + value the API still stores for the flag. """ def execute(self) -> List[CheckReportGoogleWorkspace]: @@ -26,8 +29,23 @@ class drive_publishing_files_disabled(Check): ) allow_publishing = drive_client.policies.allow_publishing_files + sharing_mode = drive_client.policies.external_sharing_mode - if allow_publishing is False: + if sharing_mode == "ALLOWLISTED_DOMAINS": + report.status = "PASS" + report.status_extended = ( + f"Publishing files to the web is not possible in domain " + f"{drive_client.provider.identity.domain}: sharing outside of " + f"the organization is limited to allowlisted domains." + ) + elif sharing_mode == "DISALLOWED": + report.status = "PASS" + report.status_extended = ( + f"Publishing files to the web is not possible in domain " + f"{drive_client.provider.identity.domain}: sharing outside of " + f"the organization is off." + ) + elif allow_publishing is False: report.status = "PASS" report.status_extended = ( f"Publishing files to the web is disabled in domain " diff --git a/tests/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled_test.py b/tests/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled_test.py index 652600f3ea..9f5d868596 100644 --- a/tests/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled_test.py +++ b/tests/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled_test.py @@ -3,6 +3,7 @@ from unittest.mock import patch from prowler.providers.googleworkspace.services.drive.drive_service import DrivePolicies from tests.providers.googleworkspace.googleworkspace_fixtures import ( CUSTOMER_ID, + DOMAIN, set_mocked_googleworkspace_provider, ) @@ -38,6 +39,106 @@ class TestDrivePublishingFilesDisabled: assert findings[0].resource_name == "Drive Policies" assert findings[0].customer_id == CUSTOMER_ID + def test_pass_when_external_sharing_is_limited_to_allowlisted_domains(self): + """The publishing flag only applies when sharing outside the organization is ON. + + Under "Allowlisted domains" the Admin console hides the option and + nothing can be made visible to anyone with the link, whatever value + the API still stores for the flag. + """ + mock_provider = set_mocked_googleworkspace_provider() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=mock_provider, + ), + patch( + "prowler.providers.googleworkspace.services.drive.drive_publishing_files_disabled.drive_publishing_files_disabled.drive_client" + ) as mock_drive_client, + ): + from prowler.providers.googleworkspace.services.drive.drive_publishing_files_disabled.drive_publishing_files_disabled import ( + drive_publishing_files_disabled, + ) + + mock_drive_client.provider = mock_provider + mock_drive_client.policies_fetched = True + mock_drive_client.policies = DrivePolicies( + external_sharing_mode="ALLOWLISTED_DOMAINS", + allow_publishing_files=True, + ) + + findings = drive_publishing_files_disabled().execute() + + assert len(findings) == 1 + assert findings[0].status == "PASS" + assert findings[0].status_extended == ( + f"Publishing files to the web is not possible in domain {DOMAIN}: " + f"sharing outside of the organization is limited to allowlisted " + f"domains." + ) + + def test_pass_when_external_sharing_is_off(self): + mock_provider = set_mocked_googleworkspace_provider() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=mock_provider, + ), + patch( + "prowler.providers.googleworkspace.services.drive.drive_publishing_files_disabled.drive_publishing_files_disabled.drive_client" + ) as mock_drive_client, + ): + from prowler.providers.googleworkspace.services.drive.drive_publishing_files_disabled.drive_publishing_files_disabled import ( + drive_publishing_files_disabled, + ) + + mock_drive_client.provider = mock_provider + mock_drive_client.policies_fetched = True + mock_drive_client.policies = DrivePolicies( + external_sharing_mode="DISALLOWED", + allow_publishing_files=None, + ) + + findings = drive_publishing_files_disabled().execute() + + assert len(findings) == 1 + assert findings[0].status == "PASS" + assert findings[0].status_extended == ( + f"Publishing files to the web is not possible in domain {DOMAIN}: " + f"sharing outside of the organization is off." + ) + + def test_fail_when_external_sharing_is_on_and_publishing_is_allowed(self): + mock_provider = set_mocked_googleworkspace_provider() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=mock_provider, + ), + patch( + "prowler.providers.googleworkspace.services.drive.drive_publishing_files_disabled.drive_publishing_files_disabled.drive_client" + ) as mock_drive_client, + ): + from prowler.providers.googleworkspace.services.drive.drive_publishing_files_disabled.drive_publishing_files_disabled import ( + drive_publishing_files_disabled, + ) + + mock_drive_client.provider = mock_provider + mock_drive_client.policies_fetched = True + mock_drive_client.policies = DrivePolicies( + external_sharing_mode="ALLOWED", + allow_publishing_files=True, + ) + + findings = drive_publishing_files_disabled().execute() + + assert len(findings) == 1 + assert findings[0].status == "FAIL" + assert "enabled" in findings[0].status_extended + def test_fail_publishing_enabled(self): """Test FAIL when publishing files to web is enabled""" mock_provider = set_mocked_googleworkspace_provider()