Description

Detects when the reviewer policy of an Azure DevOps repository keeps previous approvals after new commits are pushed to a pull request. An approval given to one version of a change then stands for a different one, so code that nobody reviewed completes into the default branch carrying a review that was granted for something else.

Detection Strategy

• Lists every project in the Azure DevOps organization and every Git repository inside each project

• Keeps only the policies that are enabled, blocking and not deleted, and finds the reviewer policy among them by its type identifier

• Reads the two independent reset settings of that policy, either of which discards previous votes when the source branch receives a new push

• Reports a vulnerability when neither is enabled, so approvals survive the commits that came after them; a branch that requires no review is left to the code review check so that one setting does not produce two findings