Description

Detects when the default branch of an Azure DevOps repository is covered by no enforced branch policy. A policy that is disabled, deleted or configured as optional leaves the branch as open as one with no policy at all: changes reach the branch the organization releases from without review, without a passing build and without any of the conditions the policy was created to impose.

Detection Strategy

• Lists every project in the Azure DevOps organization and every Git repository inside each project

• Skips repositories with no default branch, since a repository without commits has no branch to protect

• Requests the branch policies that apply to the default branch through the preview route, which is the only one that resolves a project level policy down onto the repositories it covers

• Reports a vulnerability when no policy on that branch is at once enabled, blocking and not deleted, since a policy that does not block states its verdict without stopping the merge