{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule/", "slug": "dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule", "url": "https://update.dsesecurity.com/updates/dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule/" }, "title": "Guard short input before calling substring in an Azure Policy rule", "summary": "Separate a deliberate policy result from a template-function error.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:14+00:00", "modified_at": "2026-09-17T16:35:04+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 212, "potentially_affected": "Use this review for a custom rule that derives a value from resource input, particularly a naming rule that takes a fixed-length prefix. Identify the minimum input length and the intended decision for shorter values before changing the expression.", "dse_recommendation": "DSE recommends building test inputs around the expression's boundary: shorter than required, exactly the boundary length and longer examples that both match and fail.", "primary_source": { "name": "Details of the policy definition structure policy rules - Azure Policy | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure-policy-rule", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft demonstrates an Azure Policy rule that checks a name’s length with if before calling substring. For a name shorter than the requested prefix, the guarded expression returns another value instead of raising an evaluation error. The short name can still fail the intended policy condition. Microsoft Learn.

\n

Applicability

\n

Use this review for a custom rule that derives a value from resource input, particularly a naming rule that takes a fixed-length prefix. Identify the minimum input length and the intended decision for shorter values before changing the expression.

\n

DSE recommendation

\n

DSE recommends building test inputs around the expression’s boundary: shorter than required, exactly the boundary length and longer examples that both match and fail. Make the fallback result explicit and have another reviewer verify that it expresses the intended rule. Evaluate the revised definition in an approved non-enforcing test scope before considering enforcement.

\n

Verification

\n

Compare the evaluation result for each input with the written expectation. Confirm that short input produces an ordinary policy outcome instead of a function error, and that valid-length mismatches are still detected. Preserve the expression and test resource examples with the change. A successful matching example alone is insufficient evidence for this boundary condition.

\n

Official references

\n

Microsoft Learn: Details of the policy definition structure policy rules.

", "content_text": "Source facts\nMicrosoft demonstrates an Azure Policy rule that checks a name’s length with if before calling substring. For a name shorter than the requested prefix, the guarded expression returns another value instead of raising an evaluation error. The short name can still fail the intended policy condition. Microsoft Learn.\nApplicability\nUse this review for a custom rule that derives a value from resource input, particularly a naming rule that takes a fixed-length prefix. Identify the minimum input length and the intended decision for shorter values before changing the expression.\nDSE recommendation\nDSE recommends building test inputs around the expression’s boundary: shorter than required, exactly the boundary length and longer examples that both match and fail. Make the fallback result explicit and have another reviewer verify that it expresses the intended rule. Evaluate the revised definition in an approved non-enforcing test scope before considering enforcement.\nVerification\nCompare the evaluation result for each input with the written expectation. Confirm that short input produces an ordinary policy outcome instead of a function error, and that valid-length mismatches are still detected. Preserve the expression and test resource examples with the change. A successful matching example alone is insufficient evidence for this boundary condition.\nOfficial references\nMicrosoft Learn: Details of the policy definition structure policy rules.", "content_markdown": "## Source facts\n\nMicrosoft demonstrates an Azure Policy rule that checks a name’s length with if before calling substring. For a name shorter than the requested prefix, the guarded expression returns another value instead of raising an evaluation error. The short name can still fail the intended policy condition. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure-policy-rule).\n\n## Applicability\n\nUse this review for a custom rule that derives a value from resource input, particularly a naming rule that takes a fixed-length prefix. Identify the minimum input length and the intended decision for shorter values before changing the expression.\n\n## DSE recommendation\n\nDSE recommends building test inputs around the expression’s boundary: shorter than required, exactly the boundary length and longer examples that both match and fail. Make the fallback result explicit and have another reviewer verify that it expresses the intended rule. Evaluate the revised definition in an approved non-enforcing test scope before considering enforcement.\n\n## Verification\n\nCompare the evaluation result for each input with the written expectation. Confirm that short input produces an ordinary policy outcome instead of a function error, and that valid-length mismatches are still detected. Preserve the expression and test resource examples with the change. A successful matching example alone is insufficient evidence for this boundary condition.\n\n## Official references\n\n[Microsoft Learn: Details of the policy definition structure policy rules](https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure-policy-rule)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule/", "url": "https://update.dsesecurity.com/updates/dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Guard short input before calling substring in an Azure Policy rule", "item": "https://update.dsesecurity.com/updates/dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule/", "url": "https://update.dsesecurity.com/updates/dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule/", "headline": "Guard short input before calling substring in an Azure Policy rule", "description": "Separate a deliberate policy result from a template-function error.", "abstract": "Separate a deliberate policy result from a template-function error.", "articleBody": "Source facts\nMicrosoft demonstrates an Azure Policy rule that checks a name’s length with if before calling substring. For a name shorter than the requested prefix, the guarded expression returns another value instead of raising an evaluation error. The short name can still fail the intended policy condition. Microsoft Learn.\nApplicability\nUse this review for a custom rule that derives a value from resource input, particularly a naming rule that takes a fixed-length prefix. Identify the minimum input length and the intended decision for shorter values before changing the expression.\nDSE recommendation\nDSE recommends building test inputs around the expression’s boundary: shorter than required, exactly the boundary length and longer examples that both match and fail. Make the fallback result explicit and have another reviewer verify that it expresses the intended rule. Evaluate the revised definition in an approved non-enforcing test scope before considering enforcement.\nVerification\nCompare the evaluation result for each input with the written expectation. Confirm that short input produces an ordinary policy outcome instead of a function error, and that valid-length mismatches are still detected. Preserve the expression and test resource examples with the change. A successful matching example alone is insufficient evidence for this boundary condition.\nOfficial references\nMicrosoft Learn: Details of the policy definition structure policy rules.", "datePublished": "2026-09-17T16:34:14+00:00", "dateModified": "2026-09-17T16:35:04+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Guard short input before calling substring in an Azure Policy rule" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 212, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Details of the policy definition structure policy rules - Azure Policy | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure-policy-rule" } } ] } }