feat: gatekeeper repo ambiguous prefix

checks/kubernetes/gatekeeper/repo_ambiguous_prefix.rego

@@ -0,0 +1,41 @@
+# METADATA
+# title: Gatekeeper repo reference is ambiguously open-ended
+# description: A Gatekeeper policy that references image repositories for prefix-matching is using open-ended and ambiguous pattern, and can potentially match unintended repositories.
+# schemas:
+#   - input: schema["kubernetes"]
+# custom:
+#   id: KSV-0124
+#   avdid: AVD-KSV-0124
+#   severity: HIGH
+package builtin.kubernetes.KSV0124
+import rego.v1
+
+relevan_resource if {
+    input.apiVersion == "constraints.gatekeeper.sh/v1beta1"
+    input.kind == "K8sAllowedRepos"
+}
+
+deny contains res if {
+    relevan_resource
+    some repo in input.spec.parameters.repos
+    not contains(repo,"/")
+    not contains(repo,":")
+    res := result.new(
+        "open-ended repository reference in prefix match",
+        repo
+    )
+}
+
+deny contains res if {
+    relevan_resource
+    some repo in input.spec.parameters.repos
+    parts:=split(repo,"/")
+    parts[0] == "docker.io"
+    count(parts) <= 2
+    res := result.new(
+        "open-ended repository reference in prefix match",
+        repo
+    )
+}
+
+

checks/kubernetes/gatekeeper/repo_ambiguous_prefix_test.rego

@@ -0,0 +1,70 @@
+package builtin.kubernetes.TBD001
+
+import rego.v1
+
+bad_repos := {
+	"myregistry.io", # circumvented by: myregistry.io.attacker.com
+	"myusername", # circumvented by: myusernameattacker
+	"ubuntu", # circumvented by: ubuntu.attacker.com/evil, ubuntuevil
+	"docker.io/ubuntu", # circumvented by: docker.io/ubuntuattacker/evil
+}
+
+good_repos := {
+	"myregistry.azurecr.io/",
+	"myusername/",
+	"myimage:",
+	"docker.io/library/ubuntu",
+}
+
+test_bad_repos if {
+	cases := [
+	{
+		"apiVersion": "constraints.gatekeeper.sh/v1beta1",
+		"kind": "K8sAllowedRepos",
+		"metadata": {"name": "allowedrepos"},
+		"spec": {
+			"match": {
+				"kinds": [{
+					"apiGroups": [""],
+					"kinds": ["Pod"],
+				}],
+				"namespaces": ["default"],
+			},
+			"parameters": {"repos": [repo]},
+		},
+	} |
+		some repo in bad_repos
+	]
+	every case in cases {
+		r := deny with input as case
+		count(r) > 0
+	}
+}
+
+test_good_repos if {
+	cases := [
+	{
+		"apiVersion": "constraints.gatekeeper.sh/v1beta1",
+		"kind": "K8sAllowedRepos",
+		"metadata": {"name": "allowedrepos"},
+		"spec": {
+			"match": {
+				"kinds": [{
+					"apiGroups": [""],
+					"kinds": ["Pod"],
+				}],
+				"namespaces": ["default"],
+			},
+			"parameters": {"repos": [repo]},
+		},
+	} |
+		some repo in good_repos
+	]
+
+	every case in cases {
+		r := deny with input as case
+		count(r) == 0
+	}
+}
+
+