Description

Detects when the reviewer policy of an Azure DevOps repository lets the author's own vote count toward the approvals it requires. The person who wrote a change can then supply the approval that lets it complete, so the review requirement is satisfied without anyone else having read the code.

Detection Strategy

• Lists every project in the Azure DevOps organization and every Git repository inside each project

• Keeps only the policies that are enabled, blocking and not deleted, and finds the reviewer policy among them by its type identifier

• Reads the setting that decides whether the creator's own vote counts toward the required approvals, treating an absent setting as permitting it so a value the API omits is reported rather than cleared

• Reports a vulnerability when the author's own vote counts; a branch that requires no review is left to the code review check so that one setting does not produce two findings