fix(sharepoint): false positives on disabled external sharing (#9325)

Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com>
This commit is contained in:
Prowler BotandHugo Pereira Brito authored and GitHub committed 2025-11-26 12:35:07 +01:00
1 parent 82c09ba648
commit f44d4328a3
3 files changed
+63 -7

No files matched your search

@@ -55,6 +55,53 @@ class Test_sharepoint_external_sharing_managed:
assert result[0].resource_name == "SharePoint Settings"
assert result[0].resource == sharepoint_client.settings.dict()
def test_external_sharing_disabled(self):
"""
Test when external sharing is disabled at organization level:
The check should PASS since domain restrictions are not applicable.
"""
sharepoint_client = mock.MagicMock
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_m365_provider(),
),
mock.patch("prowler.providers.m365.lib.service.service.M365PowerShell"),
mock.patch(
"prowler.providers.m365.services.sharepoint.sharepoint_external_sharing_managed.sharepoint_external_sharing_managed.sharepoint_client",
new=sharepoint_client,
),
):
from prowler.providers.m365.services.sharepoint.sharepoint_external_sharing_managed.sharepoint_external_sharing_managed import (
sharepoint_external_sharing_managed,
)
sharepoint_client.settings = SharePointSettings(
sharingCapability="Disabled",
sharingAllowedDomainList=[],
sharingBlockedDomainList=[],
legacyAuth=True,
resharingEnabled=False,
sharingDomainRestrictionMode="none",
allowedDomainGuidsForSyncApp=[uuid.uuid4()],
)
sharepoint_client.tenant_domain = DOMAIN
check = sharepoint_external_sharing_managed()
result = check.execute()
assert len(result) == 1
assert result[0].status == "PASS"
assert (
result[0].status_extended
== "External sharing is disabled at organization level."
)
assert result[0].resource_id == "sharepointSettings"
assert result[0].location == "global"
assert result[0].resource_name == "SharePoint Settings"
assert result[0].resource == sharepoint_client.settings.dict()
def test_allow_list_empty(self):
"""
Test when sharingDomainRestrictionMode is "allowList" but AllowedDomainList is empty: