diff --git a/prowler/providers/github/services/repository/repository_enforces_admin_branch_protection/__init__.py b/prowler/providers/github/services/repository/repository_enforces_admin_branch_protection/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/github/services/repository/repository_enforces_admin_branch_protection/repository_enforces_admin_branch_protection.metadata.json b/prowler/providers/github/services/repository/repository_enforces_admin_branch_protection/repository_enforces_admin_branch_protection.metadata.json new file mode 100644 index 0000000000..e99e2a4f1a --- /dev/null +++ b/prowler/providers/github/services/repository/repository_enforces_admin_branch_protection/repository_enforces_admin_branch_protection.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "github", + "CheckID": "repository_enforces_admin_branch_protection", + "CheckTitle": "Check if repository enforces admin branch protection", + "CheckType": [], + "ServiceName": "repository", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "Other", + "Description": "Ensure that the repository enforces branch protection rules for administrators.", + "Risk": "Excluding administrators from branch protection rules introduces a significant risk of unauthorized or unreviewed changes being pushed to protected branches. This can lead to vulnerabilities, including the potential insertion of malicious code, especially if an administrator account is compromised.", + "RelatedUrl": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#do-not-allow-bypassing-the-above-settings", + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "", + "Terraform": "" + }, + "Recommendation": { + "Text": "Enforce branch protection rules for administrators to ensure they adhere to the same security and quality standards as other users. This mitigates the risk of unreviewed or untrusted code being introduced, enhancing the overall integrity of the codebase.", + "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/prowler/providers/github/services/repository/repository_enforces_admin_branch_protection/repository_enforces_admin_branch_protection.py b/prowler/providers/github/services/repository/repository_enforces_admin_branch_protection/repository_enforces_admin_branch_protection.py new file mode 100644 index 0000000000..9ef3a192f2 --- /dev/null +++ b/prowler/providers/github/services/repository/repository_enforces_admin_branch_protection/repository_enforces_admin_branch_protection.py @@ -0,0 +1,40 @@ +from typing import List + +from prowler.lib.check.models import Check, Check_Report_Github +from prowler.providers.github.services.repository.repository_client import ( + repository_client, +) + + +class repository_enforces_admin_branch_protection(Check): + """Check if a repository enforces administrators to be subject to the same branch protection rules as other users + + This class verifies whether each repository enforces administrators to be subject to the same branch protection rules as other users. + """ + + def execute(self) -> List[Check_Report_Github]: + """Execute the Github Repository Enforces Admin Branch Protection check + + Iterates over all repositories and checks if they enforce administrators to be subject to the same branch protection rules as other users. + + Returns: + List[Check_Report_Github]: A list of reports for each repository. + """ + findings = [] + for repo in repository_client.repositories.values(): + report = Check_Report_Github(self.metadata()) + report.resource_id = repo.id + report.resource_name = repo.name + report.status = "FAIL" + report.status_extended = f"Repository {repo.name} does not enforce administrators to be subject to the same branch protection rules as other users." + + if ( + repo.default_branch_protection + and repo.default_branch_protection.enforce_admins + ): + report.status = "PASS" + report.status_extended = f"Repository {repo.name} does enforce administrators to be subject to the same branch protection rules as other users." + + findings.append(report) + + return findings diff --git a/prowler/providers/github/services/repository/repository_service.py b/prowler/providers/github/services/repository/repository_service.py index 6226cda769..ef76e13e7f 100644 --- a/prowler/providers/github/services/repository/repository_service.py +++ b/prowler/providers/github/services/repository/repository_service.py @@ -44,22 +44,14 @@ class Repository(GithubService): if require_pr else 0 ) - required_linear_history = ( - protection.required_linear_history - ) - allow_force_pushes = protection.allow_force_pushes - branch_deletion = protection.allow_deletions - status_checks = ( - protection.required_status_checks.strict - ) - branch_protection = Protection( require_pull_request=require_pr, approval_count=approval_cnt, - linear_history=required_linear_history, - allow_force_push=allow_force_pushes, - allow_branch_deletion=branch_deletion, - enforce_status_checks=status_checks, + linear_history=protection.required_linear_history, + allow_force_push=protection.allow_force_pushes, + allow_branch_deletion=protection.allow_deletions, + enforce_status_checks=protection.required_status_checks.strict, + enforce_admins=protection.enforce_admins, ) except Exception as e: @@ -93,6 +85,7 @@ class Protection(BaseModel): allow_force_push: bool = True allow_branch_deletion: bool = True enforce_status_checks: bool = False + enforce_admins: bool = False class Repo(BaseModel):