Ccodemod

codemod/admin-services-ip-allowlist

Read-only audit of deployment template JSON for web application service administration endpoints that do not inherit an existing explicit IP allowlist from the main site configuration.

securitydeploymentjsonweb-serviceip-allowlistcode-miningreporting
Public
0 executions
Use dashboardApply to Repository

Run locally

npx codemod @codemod/admin-services-ip-allowlist

@codemod/admin-services-ip-allowlist

Read-only audit of deployment template JSON for web application service administration endpoints that do not inherit the same explicit IP allowlist already applied to the main site.

Installation

bash

What It Reports

This codemod targets deployment template .json files and reports web application service resources when all of these are true:

  • The resource is web/sites, web/sites/config, or a nested child config resource.
  • The main site already defines ipSecurityRestrictions as a literal allowlist of specific IPs or CIDR ranges.
  • That allowlist does not contain broad entries such as 0.0.0.0/0, ::/0, *, Any, or Internet.
  • scmIpSecurityRestrictionsUseMain is missing or explicitly false.

When those conditions hold, the codemod emits a finding and metrics. It does not edit source files.

Preserve Cases

  • Resources that already set scmIpSecurityRestrictionsUseMain to true
  • Resources whose ipSecurityRestrictions include broad allow rules
  • Resources that use service tags, expressions, or other non-literal values instead of explicit IP/CIDR allow entries
  • Unrelated deployment resources and non-resource JSON objects
  • Embedded templates are reported only when the nested resources themselves match the supported shapes

Metrics

  • admin_services_ip_allowlist_files
  • admin_services_ip_allowlist_findings
  • admin_services_ip_allowlist_resources_scanned

Development

bash

License

MIT

Ready to contribute?

Build your own codemod and share it with the community.

Publish a codemodJoin the community