| 190 | } |
| 191 | |
| 192 | func ApplicationRestrictionsDisabled(org string) Issue { |
| 193 | return Issue{ |
| 194 | ID: LEAST_PRIV_OAUTH_PERMS_DISABLED, |
| 195 | Name: AvailableChecks[LEAST_PRIV_OAUTH_PERMS_DISABLED], |
| 196 | Severity: severity.High, |
| 197 | Category: category.LeastPrivilege, |
| 198 | Description: fmt.Sprintf( |
| 199 | "Application restrictions for organization '%s' is disabled. Without OAuth App access restrictions any App is automatically granted access to the organization account when any organization member installs and authorizes the App, even if they do so for a personal account. This can lead to untrusted apps accessing organization resources", |
| 200 | org, |
| 201 | ), |
| 202 | Resources: []resource.Resource{ |
| 203 | { |
| 204 | ID: org, |
| 205 | Kind: resource.Organization, |
| 206 | }, |
| 207 | }, |
| 208 | Remediation: "Please see https://docs.github.com/en/organizations/restricting-access-to-your-organizations-data/about-oauth-app-access-restrictions for steps on how to configure OAuth App access for your organization", |
| 209 | } |
| 210 | } |
| 211 | |
| 212 | func OAuthStats(org string, appinfo []string) Issue { |
| 213 | return Issue{ |