Repository: bridgecrewio/checkov
Pull request: fix(bicep): Update AppServiceHttps20Enabled to consider newer ApiVersion
**By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.**

[//]: # "
    # PR Title
    Be aware that we use the title to create changelog automatically and therefore only allow specific prefixes
    - break:    to indicate a breaking change, this supersedes any of the types
    - feat:     to indicate new features or checks
    - fix:      to indicate a bugfix or handling of edge cases of existing checks
    - docs:     to indicate an update to our documentation
    - chore:    to indicate adjustments to workflow files or dependency updates
    - platform: to indicate a change needed for the platform
    Additionally a scope is needs to be added to the prefix, which indicates the targeted framework, in doubt choose 'general'.
    #    
    Allowed prefixs:
    ansible|argo|arm|azure|bicep|bitbucket|circleci|cloudformation|dockerfile|github|gha|gitlab|helm|kubernetes|kustomize|openapi|sast|sca|secrets|serverless|terraform|general|graph|terraform_plan|terraform_json
    #
    ex.
    feat(terraform): add CKV_AWS_123 to ensure that VPC Endpoint Service is configured for Manual Acceptance
"

## Description

*Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.*

Fixes # (issue)

## New/Edited policies (Delete if not relevant)

### Description
*Include a description of what makes it a violation and any relevant external links.*

### Fix
*How does someone fix the issue in code and/or in runtime?*

## Checklist:

- [ ] My code follows the style guidelines of this project
- [ ] I have performed a self-review of my own code
- [ ] I have commented my code, particularly in hard-to-understand areas
- [ ] I have made corresponding changes to the documentation
- [ ] I have added tests that prove my feature, policy, or fix is effective and works
- [ ] New and existing tests pass locally with my changes
- [ ] Any dependent changes have been merged and published in downstream modules


Problem statement:
CKV_AZURE_18 still detecting
**Describe the issue**
We are adding the `http20Enabled` marker to the site config but checkov is still giving the error

the error message is:
```Ensure that 'HTTP Version' is the latest if used to run the web app```

**Examples**
```
resource _webApplication 'Microsoft.Web/sites@2022-03-01' = {
  dependsOn: []
  name: format(subNameInfix, 'WA', WaName, WAnumber)
  location: Location
  tags: Tags
  kind: WaKind
  properties: {
    serverFarmId: _asp.id
    httpsOnly: HttpsOnly
    reserved: Reserved
    siteConfig: {
      http20Enabled: true
    }
}
```

**Version (please complete the following information):**
 - checkov-3.1.9

**Additional context**
Add any other context about the problem here.

Hints from issue discussion:

Commit message: Fixed the check

Patch to review:
diff --git a/checkov/arm/checks/resource/AppServiceHttps20Enabled.py b/checkov/arm/checks/resource/AppServiceHttps20Enabled.py
index 411a2486e1..899979cbc3 100644
--- a/checkov/arm/checks/resource/AppServiceHttps20Enabled.py
+++ b/checkov/arm/checks/resource/AppServiceHttps20Enabled.py
@@ -1,10 +1,14 @@
+from __future__ import annotations
+
 from typing import Any
 
-from checkov.arm.base_resource_value_check import BaseResourceValueCheck
-from checkov.common.models.enums import CheckCategories
+from checkov.arm.base_resource_check import BaseResourceCheck
+from checkov.common.models.enums import CheckResult, CheckCategories
 
 
-class AppServiceHttps20Enabled(BaseResourceValueCheck):
+class AppServiceHttps20Enabled(BaseResourceCheck):
+    # apiVersion = 2018-11-01 - http20Enabled is a string
+    # apiVersion > 2020-10-01  - http20Enabled is a boolean
     def __init__(self) -> None:
         name = "Ensure that 'HTTP Version' is the latest if used to run the web app"
         id = "CKV_AZURE_18"
@@ -12,12 +16,18 @@ def __init__(self) -> None:
         categories = (CheckCategories.NETWORKING,)
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def get_inspected_key(self) -> str:
-        # https://docs.microsoft.com/en-us/azure/templates/microsoft.web/2019-08-01/sites
-        return "properties/siteConfig/http20Enabled"
-
-    def get_expected_value(self) -> Any:
-        return "true"
+    def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
+        if "properties" in conf:
+            if "siteConfig" in conf["properties"] and conf["properties"]["siteConfig"]:
+                if "http20Enabled" in conf["properties"]["siteConfig"]:
+                    http_20_enabled = conf["properties"]["siteConfig"]["http20Enabled"]
+                    if "apiVersion" in conf:
+                        if conf["apiVersion"] == "2018-11-01":
+                            if isinstance(http_20_enabled, str) and str(http_20_enabled).lower() == "true":
+                                return CheckResult.PASSED
+                        elif isinstance(http_20_enabled, bool) and http_20_enabled:
+                            return CheckResult.PASSED
+        return CheckResult.FAILED
 
 
 check = AppServiceHttps20Enabled()
diff --git a/tests/arm/checks/resource/example_AppServiceHttps20Enabled/appServiceHttps20Enabled-PASSED2.json b/tests/arm/checks/resource/example_AppServiceHttps20Enabled/appServiceHttps20Enabled-PASSED2.json
new file mode 100644
index 0000000000..4802459929
--- /dev/null
+++ b/tests/arm/checks/resource/example_AppServiceHttps20Enabled/appServiceHttps20Enabled-PASSED2.json
@@ -0,0 +1,75 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "webAppName": {
+      "type": "string",
+      "defaultValue" : "AzureLinuxApp",
+      "metadata": {
+        "description": "Base name of the resource such as web app name and app service plan "
+      },
+      "minLength": 2
+    },
+    "sku":{
+      "type": "string",
+      "defaultValue" : "S1",
+      "metadata": {
+        "description": "The SKU of App Service Plan "
+      }
+    },
+    "linuxFxVersion" : {
+      "type": "string",
+      "defaultValue" : "php|7.0",
+      "metadata": {
+        "description": "The Runtime stack of current web app"
+      }
+    },
+    "location": {
+      "type": "string",
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "description": "Location for all resources."
+      }
+    }
+  },
+  "variables": {
+    "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]"
+  },
+  "resources": [
+    {
+      "type": "Microsoft.Web/serverfarms",
+      "apiVersion": "2018-02-01",
+      "name": "[variables('appServicePlanName')]",
+      "location": "[parameters('location')]",
+      "sku": {
+        "name": "[parameters('sku')]"
+      },
+      "kind": "linux",
+      "properties":{
+        "reserved":true
+      }
+    },
+    {
+      "type": "Microsoft.Web/sites",
+      "apiVersion": "2022-03-01",
+      "name": "enabled_newer",
+      "location": "[parameters('location')]",
+      "kind": "app",
+      "dependsOn": [
+        "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]"
+      ],
+      "identity": {
+        "type": "SystemAssigned"
+      },
+      "properties": {
+        "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]",
+        "siteConfig": {
+          "linuxFxVersion": "[parameters('linuxFxVersion')]",
+          "http20Enabled": true,
+          "minTlsVersion": "1.2"
+        },
+        "clientCertEnabled": true
+      }
+    }
+  ]
+}
diff --git a/tests/arm/checks/resource/test_AppServiceHttps20Enabled.py b/tests/arm/checks/resource/test_AppServiceHttps20Enabled.py
index 8b3b012950..2a68cef33b 100644
--- a/tests/arm/checks/resource/test_AppServiceHttps20Enabled.py
+++ b/tests/arm/checks/resource/test_AppServiceHttps20Enabled.py
@@ -19,6 +19,7 @@ def test_summary(self):
 
         passing_resources = {
             "Microsoft.Web/sites.enabled",
+            "Microsoft.Web/sites.enabled_newer",
         }
         failing_resources = {
             "Microsoft.Web/sites.default",
@@ -29,7 +30,7 @@ def test_summary(self):
         passed_check_resources = {c.resource for c in report.passed_checks}
         failed_check_resources = {c.resource for c in report.failed_checks}
 
-        self.assertEqual(summary["passed"], 1)
+        self.assertEqual(summary["passed"], 2)
         self.assertEqual(summary["failed"], 3)
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)


Code review comments:
diff_hunk: @@ -1,23 +1,33 @@
+from __future__ import annotations
+
 from typing import Any
 
-from checkov.arm.base_resource_value_check import BaseResourceValueCheck
-from checkov.common.models.enums import CheckCategories
+from checkov.arm.base_resource_check import BaseResourceCheck
+from checkov.common.models.enums import CheckResult, CheckCategories
 
 
-class AppServiceHttps20Enabled(BaseResourceValueCheck):
+class AppServiceHttps20Enabled(BaseResourceCheck):
+    # apiVersion = 2018-11-01 - http20Enabled is a string
+    # apiVersion > 2020-10-01  - http20Enabled is a boolean
     def __init__(self) -> None:
         name = "Ensure that 'HTTP Version' is the latest if used to run the web app"
         id = "CKV_AZURE_18"
         supported_resources = ("Microsoft.Web/sites",)
         categories = (CheckCategories.NETWORKING,)
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def get_inspected_key(self) -> str:
-        # https://docs.microsoft.com/en-us/azure/templates/microsoft.web/2019-08-01/sites
-        return "properties/siteConfig/http20Enabled"
-
-    def get_expected_value(self) -> Any:
-        return "true"
+    def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
+        if "properties" in conf:
+            if "siteConfig" in conf["properties"] and conf["properties"]["siteConfig"]:
+                if "http20Enabled" in conf["properties"]["siteConfig"]:
+                    http_20_enabled = conf["properties"]["siteConfig"]["http20Enabled"]
path: checkov/arm/checks/resource/AppServiceHttps20Enabled.py
text: @user1:
you could use `find_in_dict()` like this to do the same 🙂 
```suggestion
        http_20_enabled = find_in_dict(conf, "properties/siteConfig/http20Enabled")
```

@author:
@user1 Nice one