From 21483cc12fcac1bf8d5e461a73de5decc65bdc8f Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Thu, 16 Apr 2026 13:36:14 +0200 Subject: [PATCH] fix(googleworkspace): treat secure Google defaults as PASS for Calendar checks (#10735) Co-authored-by: lydiavilchez <114735608+lydiavilchez@users.noreply.github.com> Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com> --- prowler/CHANGELOG.md | 1 + .../calendar_external_invitations_warning.py | 25 +++++++++---------- ...endar_external_sharing_primary_calendar.py | 24 +++++++++--------- ...endar_external_invitations_warning_test.py | 8 +++--- ..._external_sharing_primary_calendar_test.py | 8 +++--- 5 files changed, 33 insertions(+), 33 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 071ea5088e..6fa0d3a0d1 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -7,6 +7,7 @@ All notable changes to the **Prowler SDK** are documented in this file. ### 🐞 Fixed - Cloudflare account-scoped API tokens failing connection test in the App with `CloudflareUserTokenRequiredError` [(#10723)](https://github.com/prowler-cloud/prowler/pull/10723) +- Google Workspace Calendar checks false FAIL on unconfigured settings with secure Google defaults [(#10726)](https://github.com/prowler-cloud/prowler/pull/10726) - `prowler image --registry` failing with `ImageNoImagesProvidedError` due to registry arguments not being forwarded to `ImageProvider` in `init_global_provider` [(#10470)](https://github.com/prowler-cloud/prowler/pull/10470) --- diff --git a/prowler/providers/googleworkspace/services/calendar/calendar_external_invitations_warning/calendar_external_invitations_warning.py b/prowler/providers/googleworkspace/services/calendar/calendar_external_invitations_warning/calendar_external_invitations_warning.py index 7af51cbfba..1da8769b06 100644 --- a/prowler/providers/googleworkspace/services/calendar/calendar_external_invitations_warning/calendar_external_invitations_warning.py +++ b/prowler/providers/googleworkspace/services/calendar/calendar_external_invitations_warning/calendar_external_invitations_warning.py @@ -35,21 +35,20 @@ class calendar_external_invitations_warning(Check): f"External invitation warnings for Google Calendar are enabled " f"in domain {calendar_client.provider.identity.domain}." ) + elif warning_enabled is None: + report.status = "PASS" + report.status_extended = ( + f"External invitation warnings for Google Calendar use Google's " + f"secure default configuration (enabled) " + f"in domain {calendar_client.provider.identity.domain}." + ) else: report.status = "FAIL" - if warning_enabled is None: - report.status_extended = ( - f"External invitation warnings for Google Calendar are not " - f"explicitly configured in domain " - f"{calendar_client.provider.identity.domain}. " - f"Users should be warned when inviting guests outside the organization." - ) - else: - report.status_extended = ( - f"External invitation warnings for Google Calendar are disabled " - f"in domain {calendar_client.provider.identity.domain}. " - f"Users should be warned when inviting guests outside the organization." - ) + report.status_extended = ( + f"External invitation warnings for Google Calendar are disabled " + f"in domain {calendar_client.provider.identity.domain}. " + f"Users should be warned when inviting guests outside the organization." + ) findings.append(report) diff --git a/prowler/providers/googleworkspace/services/calendar/calendar_external_sharing_primary_calendar/calendar_external_sharing_primary_calendar.py b/prowler/providers/googleworkspace/services/calendar/calendar_external_sharing_primary_calendar/calendar_external_sharing_primary_calendar.py index b019acf4de..eaf9f90911 100644 --- a/prowler/providers/googleworkspace/services/calendar/calendar_external_sharing_primary_calendar/calendar_external_sharing_primary_calendar.py +++ b/prowler/providers/googleworkspace/services/calendar/calendar_external_sharing_primary_calendar/calendar_external_sharing_primary_calendar.py @@ -36,20 +36,20 @@ class calendar_external_sharing_primary_calendar(Check): f"{calendar_client.provider.identity.domain} is restricted to " f"free/busy information only." ) + elif sharing is None: + report.status = "PASS" + report.status_extended = ( + f"Primary calendar external sharing uses Google's secure default " + f"configuration (free/busy only) " + f"in domain {calendar_client.provider.identity.domain}." + ) else: report.status = "FAIL" - if sharing is None: - report.status_extended = ( - f"Primary calendar external sharing is not explicitly configured " - f"in domain {calendar_client.provider.identity.domain}. " - f"External sharing should be restricted to free/busy information only." - ) - else: - report.status_extended = ( - f"Primary calendar external sharing in domain " - f"{calendar_client.provider.identity.domain} is set to {sharing}. " - f"External sharing should be restricted to free/busy information only." - ) + report.status_extended = ( + f"Primary calendar external sharing in domain " + f"{calendar_client.provider.identity.domain} is set to {sharing}. " + f"External sharing should be restricted to free/busy information only." + ) findings.append(report) diff --git a/tests/providers/googleworkspace/services/calendar/calendar_external_invitations_warning/calendar_external_invitations_warning_test.py b/tests/providers/googleworkspace/services/calendar/calendar_external_invitations_warning/calendar_external_invitations_warning_test.py index f367d5938d..0320ea4a82 100644 --- a/tests/providers/googleworkspace/services/calendar/calendar_external_invitations_warning/calendar_external_invitations_warning_test.py +++ b/tests/providers/googleworkspace/services/calendar/calendar_external_invitations_warning/calendar_external_invitations_warning_test.py @@ -73,8 +73,8 @@ class TestCalendarExternalInvitationsWarning: assert findings[0].status == "FAIL" assert "disabled" in findings[0].status_extended - def test_fail_no_policy_set(self): - """Test FAIL when no explicit policy is set (None) but fetch succeeded""" + def test_pass_using_default(self): + """Test PASS when no explicit policy is set (None) — Google default is secure (enabled)""" mock_provider = set_mocked_googleworkspace_provider() with ( @@ -100,8 +100,8 @@ class TestCalendarExternalInvitationsWarning: findings = check.execute() assert len(findings) == 1 - assert findings[0].status == "FAIL" - assert "not explicitly configured" in findings[0].status_extended + assert findings[0].status == "PASS" + assert "secure default" in findings[0].status_extended def test_no_findings_when_fetch_failed(self): """Test no findings returned when the API fetch failed""" diff --git a/tests/providers/googleworkspace/services/calendar/calendar_external_sharing_primary_calendar/calendar_external_sharing_primary_calendar_test.py b/tests/providers/googleworkspace/services/calendar/calendar_external_sharing_primary_calendar/calendar_external_sharing_primary_calendar_test.py index 32056e9fcb..cb8713630f 100644 --- a/tests/providers/googleworkspace/services/calendar/calendar_external_sharing_primary_calendar/calendar_external_sharing_primary_calendar_test.py +++ b/tests/providers/googleworkspace/services/calendar/calendar_external_sharing_primary_calendar/calendar_external_sharing_primary_calendar_test.py @@ -104,8 +104,8 @@ class TestCalendarExternalSharingPrimaryCalendar: assert findings[0].status == "FAIL" assert "EXTERNAL_ALL_INFO_READ_WRITE" in findings[0].status_extended - def test_fail_no_policy_set(self): - """Test FAIL when no explicit policy is set (None) but fetch succeeded""" + def test_pass_using_default(self): + """Test PASS when no explicit policy is set (None) — Google default is secure (free/busy only)""" mock_provider = set_mocked_googleworkspace_provider() with ( @@ -131,8 +131,8 @@ class TestCalendarExternalSharingPrimaryCalendar: findings = check.execute() assert len(findings) == 1 - assert findings[0].status == "FAIL" - assert "not explicitly configured" in findings[0].status_extended + assert findings[0].status == "PASS" + assert "secure default" in findings[0].status_extended def test_no_findings_when_fetch_failed(self): """Test no findings returned when the API fetch failed"""