From b55122c2d8533ea6c03ac3be9dcdcbb113fa1659 Mon Sep 17 00:00:00 2001 From: Ben Gimblett Date: Fri, 21 Dec 2018 10:56:24 +0000 Subject: [PATCH] Bug in VerifyNSG() function result initialisation VerifyNSG() has a simple bug - on entering the function the result success flag is incorrectly initialised to $true (optimistic) - when it should be initialised to $false (pessimistic) ... The function can ONLY be successful on one path; IF an NSG is found WITH valid rules. As it was, if NO NSG is found the function will STILL return success and therefore the following script / code used for mitigation will not be executed. --- .../prepare-subnet/prepareSubnet.ps1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samples/manage/azure-sql-db-managed-instance/prepare-subnet/prepareSubnet.ps1 b/samples/manage/azure-sql-db-managed-instance/prepare-subnet/prepareSubnet.ps1 index cbfffa07..22e9960c 100644 --- a/samples/manage/azure-sql-db-managed-instance/prepare-subnet/prepareSubnet.ps1 +++ b/samples/manage/azure-sql-db-managed-instance/prepare-subnet/prepareSubnet.ps1 @@ -485,7 +485,7 @@ function VerifyNSG { $result = @{ nsgSecurityRules = New-Object "$NScollections.List``1[$NSnetworkModels.PSSecurityRule]" failedSecurityRules = New-Object "$NScollections.List``1[$NSnetworkModels.PSSecurityRule]" - success = $true + success = $false } Write-Host("Verifying Network security group for subnet '{0}'."-f $subnet.Name) $nsg = LoadNetworkSecurityGroup $subnet