fix(query): changed all dockerfile queries for case insensitive support of dockerfile commands #8006

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

cx-andre-pereira wants to merge 102 commits into Checkmarx:master from cx-andre-pereira:Dockerfile_queries_fix_for_case_insensitivity

.github/scripts/validate-search-line/validate_search_line.py

-Original file line number
+Diff line change
@@ Expand Up / @@ -30,6 +30,9 @@ def get_changed_queries(): @@
         dirs = []
         for f in files:
             if f.endswith("/query.rego"):
+                if f.startswith("assets/queries/dockerfile/"):
+                    print(f"  [SKIP] {f}: Dockerfile queries do not support searchLine")
+                    continue
                 dirs.append(REPO_ROOT / Path(f).parent)
         return dirs
@@ Expand Down @@

assets/libraries/dockerfile.rego

-Original file line number
+Diff line change
@@ Expand Up / @@ -69,4 +69,16 @@ check_multi_stage(imageName, images) { @@
         sortedIndex := sort(unsortedIndex)
         imageName == sortedIndex[minus(count(sortedIndex), 1)].Name
-    }
+    }
+    get_original_from_command(commands) = from_command {
+    	commands[i].Cmd == "from"
+    	from_command :=  {
+    		"Value": substring(commands[i].Original, 0, 4),
+    		"LineHint" : commands[i]._kics_line - 1
+    	}
+    }
+    add_line_hint(raw_search_key, lineHint) = searchKey {
+    	searchKey := sprintf("%s^%d", [raw_search_key, lineHint])
+    }

assets/queries/dockerfile/add_instead_of_copy/query.rego

            
                      Original file line number
                      Diff line number
                      Diff line change
                  
    @@ -3,16 +3,18 @@ package Cx
  
    import data.generic.dockerfile as dockerLib

    CxPolicy[result] {

    	resource := input.document[i].command[name][_]

    	resource.Cmd == "add"

    	stage := input.document[i].command[name]

    	not dockerLib.arrayContains(resource.Value, {".tar", ".tar."})

    	resource = stage[s]

    	stage[s].Cmd = "add"

    	not dockerLib.arrayContains(stage[s].Value, {".tar", ".tar."})

    	from_command := dockerLib.get_original_from_command(stage)

    	result := {

    		"documentId": input.document[i].id,

    		"searchKey": sprintf("FROM={{%s}}.{{%s}}", [name, resource.Original]),

    		"searchKey": dockerLib.add_line_hint(sprintf("%s={{%s}}.{{%s}}", [from_command.Value, name, resource.Original]), from_command.LineHint),

    		"issueType": "IncorrectValue",

    		"keyExpectedValue": sprintf("'COPY' %s", [resource.Value[0]]),

    		"keyActualValue": sprintf("'ADD' %s", [resource.Value[0]]),

    	}

    }

    }

0 ..._instead_of_copy/test/negative.dockerfile → ...instead_of_copy/test/negative1.dockerfile

File renamed without changes.

assets/queries/dockerfile/add_instead_of_copy/test/negative2.dockerfile

-Original file line number
+Diff line change
@@ -0,0 +1,10 @@
+    from openjdk:10-jdk
+    volume /tmp
+    arg JAR_FILE
+    copy ${JAR_FILE} app.jar
+    entrypoint ["java","-Djava.security.egd=file:/dev/./urandom","-jar","/app.jar"]
+    add http://source.file/package.file.tar.gz /temp
+    run tar -xjf /temp/package.file.tar.gz \
+      && make -C /tmp/package.file \
+      && rm /tmp/ package.file.tar.gz
+    # trigger validation

0 ..._instead_of_copy/test/positive.dockerfile → ...instead_of_copy/test/positive1.dockerfile

File renamed without changes.

assets/queries/dockerfile/add_instead_of_copy/test/positive2.dockerfile

-Original file line number
+Diff line change
@@ -0,0 +1,9 @@
+    from openjdk:10-jdk
+    volume /tmp
+    add http://source.file/package.file.tar.gz /temp
+    run tar -xjf /temp/package.file.tar.gz \
+      && make -C /tmp/package.file \
+      && rm /tmp/ package.file.tar.gz
+    arg JAR_FILE
+    add ${JAR_FILE} app.jar
+    entrypoint ["java","-Djava.security.egd=file:/dev/./urandom","-jar","/app.jar"]

assets/queries/dockerfile/add_instead_of_copy/test/positive_expected_result.json

-Original file line number
+Diff line change
@@ -1,7 +1,14 @@
     [
-      {
-        "queryName": "Add Instead of Copy",
-        "severity": "MEDIUM",
-        "line": 8
-      }
-    ]
+    	{
+    		"queryName": "Add Instead of Copy",
+    		"severity": "MEDIUM",
+    		"line": 8,
+    		"fileName": "positive1.dockerfile"
+    	},
+    	{
+    		"queryName": "Add Instead of Copy",
+    		"severity": "MEDIUM",
+    		"line": 8,
+    		"fileName": "positive2.dockerfile"
+    	}
+    ]

assets/queries/dockerfile/apk_add_using_local_cache_path/query.rego

            
                      Original file line number
                      Diff line number
                      Diff line change
                  
    @@ -10,9 +10,11 @@ CxPolicy[result] {
  
    	runCommands := dockerLib.getCommands(command.Value[0])

    	containsApkAddWithoutNoCache(runCommands)

    	stage := input.document[i].command[name]

    	from_command := dockerLib.get_original_from_command(stage)

    	result := {

    		"documentId": input.document[i].id,

    		"searchKey": sprintf("FROM={{%s}}.{{%s}}", [name, command.Original]),

    		"searchKey": dockerLib.add_line_hint(sprintf("%s={{%s}}.{{%s}}", [from_command.Value, name, command.Original]), from_command.LineHint),

    		"issueType": "IncorrectValue",

    		"keyExpectedValue": "'RUN' should not contain 'apk add' command without '--no-cache' switch",

    		"keyActualValue": "'RUN' contains 'apk add' command without '--no-cache' switch",

assets/queries/dockerfile/apk_add_using_local_cache_path/test/negative3.dockerfile

-Original file line number
+Diff line change
@@ -0,0 +1,7 @@
+    from gliderlabs/alpine:3.3
+    run apk add --no-cache python
+    workdir /app
+    onbuild COPY . /app
+    onbuild RUN virtualenv /env && /env/bin/pip install -r /app/requirements.txt
+    expose 8080
+    cmd ["/env/bin/python", "main.py"]

assets/queries/dockerfile/apk_add_using_local_cache_path/test/positive3.dockerfile

-Original file line number
+Diff line change
@@ -0,0 +1,7 @@
+    from gliderlabs/alpine:3.3
+    run apk add --update-cache python
+    workdir /app
+    onbuild COPY . /app
+    onbuild RUN virtualenv /env && /env/bin/pip install -r /app/requirements.txt
+    expose 8080
+    cmd ["/env/bin/python", "main.py"]

assets/queries/dockerfile/apk_add_using_local_cache_path/test/positive_expected_result.json

-Original file line number
+Diff line change
@@ Expand Up / @@ -10,5 +10,11 @@ @@
     		"severity": "INFO",
     		"line": 2,
     		"fileName": "positive2.dockerfile"
+    	},
+    	{
+    		"queryName": "Apk Add Using Local Cache Path",
+    		"severity": "INFO",
+    		"line": 2,
+    		"fileName": "positive3.dockerfile"
     	}
-    ]
+    ]

assets/queries/dockerfile/apt_get_install_lists_were_not_deleted/query.rego

            
                      Original file line number
                      Diff line number
                      Diff line change
                  
    @@ -1,5 +1,7 @@
  
    package Cx

    import data.generic.dockerfile as dockerLib

    CxPolicy[result] {

    	resource := input.document[i].command[name][_]

    	resource.Cmd == "run"

    @@ -10,9 +12,12 @@ CxPolicy[result] {
  
    	not hasClean(resource.Value[0], aptGet[0])

    	stage := input.document[i].command[name]

    	from_command := dockerLib.get_original_from_command(stage)

    	run_command := substring(resource.Original, 0, 3)

    	result := {

    		"documentId": input.document[i].id,

    		"searchKey": sprintf("FROM={{%s}}.RUN={{%s}}", [name, commands]),

    		"searchKey": dockerLib.add_line_hint(sprintf("%s={{%s}}.%s={{%s}}", [from_command.Value, name, run_command, commands]), from_command.LineHint),

    		"issueType": "IncorrectValue", #"MissingAttribute" / "RedundantAttribute"

    		"keyExpectedValue": "After using apt-get install, the apt-get lists should be deleted",

    		"keyActualValue": "After using apt-get install, the apt-get lists were not deleted",

assets/queries/dockerfile/apt_get_install_lists_were_not_deleted/test/negative3.dockerfile

-Original file line number
+Diff line change
@@ -0,0 +1,15 @@
+    from busyboxneg1
+    run apt-get update && apt-get install --no-install-recommends -y python \
+      && apt-get clean \
+      && rm -rf /var/lib/apt/lists/*
+    from busyboxneg2
+    run apt-get update && apt-get install --no-install-recommends -y python && apt-get clean
+    from busyboxneg3
+    run apt-get update && apt-get install --no-install-recommends -y python \
+      && apt-get clean
+    from busyboxneg4
+    run apt-get update && apt-get install --no-install-recommends -y python \
+      && rm -rf /var/lib/apt/lists/*

assets/queries/dockerfile/apt_get_install_lists_were_not_deleted/test/positive3.dockerfile

-Original file line number
+Diff line change
@@ -0,0 +1,14 @@
+    from busybox1
+    run apt-get update && apt-get install --no-install-recommends -y python
+    from busybox2
+    run apt-get install python
+    from busybox3
+    run apt-get update && apt-get install --no-install-recommends -y python
+    run rm -rf /var/lib/apt/lists/*
+    from busybox4
+    run apt-get update && apt-get install --no-install-recommends -y python
+    run rm -rf /var/lib/apt/lists/*
+    run apt-get clean

...ries/dockerfile/apt_get_install_lists_were_not_deleted/test/positive_expected_result.json

-Original file line number
+Diff line change
@@ -1,32 +1,56 @@
     [
-      {
-        "queryName": "Apt Get Install Lists Were Not Deleted",
-        "severity": "INFO",
-        "line": 2,
-        "fileName": "positive.dockerfile"
-      },
-      {
-        "queryName": "Apt Get Install Lists Were Not Deleted",
-        "severity": "INFO",
-        "line": 5,
-        "fileName": "positive.dockerfile"
-      },
-      {
-        "queryName": "Apt Get Install Lists Were Not Deleted",
-        "severity": "INFO",
-        "line": 8,
-        "fileName": "positive.dockerfile"
-      },
-      {
-        "queryName": "Apt Get Install Lists Were Not Deleted",
-        "severity": "INFO",
-        "line": 12,
-        "fileName": "positive.dockerfile"
-      },
-      {
-        "queryName": "Apt Get Install Lists Were Not Deleted",
-        "severity": "INFO",
-        "line": 2,
-        "fileName": "positive2.dockerfile"
-      }
-    ]
+    	{
+    		"queryName": "Apt Get Install Lists Were Not Deleted",
+    		"severity": "INFO",
+    		"line": 2,
+    		"fileName": "positive.dockerfile"
+    	},
+    	{
+    		"queryName": "Apt Get Install Lists Were Not Deleted",
+    		"severity": "INFO",
+    		"line": 5,
+    		"fileName": "positive.dockerfile"
+    	},
+    	{
+    		"queryName": "Apt Get Install Lists Were Not Deleted",
+    		"severity": "INFO",
+    		"line": 8,
+    		"fileName": "positive.dockerfile"
+    	},
+    	{
+    		"queryName": "Apt Get Install Lists Were Not Deleted",
+    		"severity": "INFO",
+    		"line": 12,
+    		"fileName": "positive.dockerfile"
+    	},
+    	{
+    		"queryName": "Apt Get Install Lists Were Not Deleted",
+    		"severity": "INFO",
+    		"line": 2,
+    		"fileName": "positive2.dockerfile"
+    	},
+    	{
+    		"queryName": "Apt Get Install Lists Were Not Deleted",
+    		"severity": "INFO",
+    		"line": 2,
+    		"fileName": "positive3.dockerfile"
+    	},
+    	{
+    		"queryName": "Apt Get Install Lists Were Not Deleted",
+    		"severity": "INFO",
+    		"line": 5,
+    		"fileName": "positive3.dockerfile"
+    	},
+    	{
+    		"queryName": "Apt Get Install Lists Were Not Deleted",
+    		"severity": "INFO",
+    		"line": 8,
+    		"fileName": "positive3.dockerfile"
+    	},
+    	{
+    		"queryName": "Apt Get Install Lists Were Not Deleted",
+    		"severity": "INFO",
+    		"line": 12,
+    		"fileName": "positive3.dockerfile"
+    	}
+    ]

assets/queries/dockerfile/apt_get_install_pin_version_not_defined/query.rego

            
                      Original file line number
                      Diff line number
                      Diff line change
                  
    @@ -18,9 +18,12 @@ CxPolicy[result] {
  
    	packageName := packages[j]

    	analyzePackages(j, packageName, packages, length)

    	stage := input.document[i].command[name]

    	from_command := dockerLib.get_original_from_command(stage)

    	run_command := substring(resource.Original, 0, 3)

    	result := {

    		"documentId": input.document[i].id,

    		"searchKey": sprintf("FROM={{%s}}.RUN={{%s}}", [name, commands]),

    		"searchKey": dockerLib.add_line_hint(sprintf("%s={{%s}}.%s={{%s}}", [from_command.Value, name, run_command, commands]), from_command.LineHint),

    		"searchValue": packageName,

    		"issueType": "MissingAttribute",

    		"keyExpectedValue": sprintf("Package '%s' has version defined", [packageName]),

    @@ -44,9 +47,11 @@ CxPolicy[result] {
  
    	regex.match("^[a-zA-Z]", packageName) == true

    	not dockerLib.withVersion(packageName)

    	stage := input.document[i].command[name]

    	from_command := dockerLib.get_original_from_command(stage)

    	result := {

    		"documentId": input.document[i].id,

    		"searchKey": sprintf("FROM={{%s}}.{{%s}}", [name, resource.Original]),

    		"searchKey": dockerLib.add_line_hint(sprintf("%s={{%s}}.{{%s}}", [from_command.Value, name, resource.Original]), from_command.LineHint),

    		"searchValue": packageName,

    		"issueType": "IncorrectValue",

    		"keyExpectedValue": sprintf("Package '%s' has version defined", [packageName]),

assets/queries/dockerfile/apt_get_install_pin_version_not_defined/test/negative4.dockerfile

Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		from busybox
		run apt-get install python=2.7

assets/queries/dockerfile/apt_get_install_pin_version_not_defined/test/positive3.dockerfile

-Original file line number
+Diff line change
@@ -0,0 +1,14 @@
+    from busybox
+    run apt-get install python
+    run ["apt-get", "install", "python"]
+    from busybox2
+    run apt-get install -y -t python
+    from busybox3
+    run apt-get update && apt-get install -y \
+        python-qt4 \
+        python-pyside \
+        python-pip \
+        python3-pip \
+        python3-pyqt5

...ies/dockerfile/apt_get_install_pin_version_not_defined/test/positive_expected_result.json

-Original file line number
+Diff line change
@@ Expand Up / @@ -94,5 +94,53 @@ @@
         "severity": "MEDIUM",
         "line": 9,
         "fileName": "positive2.dockerfile"
+      },
+      {
+        "queryName": "Apt Get Install Pin Version Not Defined",
+        "severity": "MEDIUM",
+        "line": 2,
+        "fileName": "positive3.dockerfile"
+      },
+      {
+        "queryName": "Apt Get Install Pin Version Not Defined",
+        "severity": "MEDIUM",
+        "line": 3,
+        "fileName": "positive3.dockerfile"
+      },
+      {
+        "queryName": "Apt Get Install Pin Version Not Defined",
+        "severity": "MEDIUM",
+        "line": 6,
+        "fileName": "positive3.dockerfile"
+      },
+      {
+        "queryName": "Apt Get Install Pin Version Not Defined",
+        "severity": "MEDIUM",
+        "line": 9,
+        "fileName": "positive3.dockerfile"
+      },
+      {
+        "queryName": "Apt Get Install Pin Version Not Defined",
+        "severity": "MEDIUM",
+        "line": 9,
+        "fileName": "positive3.dockerfile"
+      },
+      {
+        "queryName": "Apt Get Install Pin Version Not Defined",
+        "severity": "MEDIUM",
+        "line": 9,
+        "fileName": "positive3.dockerfile"
+      },
+      {
+        "queryName": "Apt Get Install Pin Version Not Defined",
+        "severity": "MEDIUM",
+        "line": 9,
+        "fileName": "positive3.dockerfile"
+      },
+      {
+        "queryName": "Apt Get Install Pin Version Not Defined",
+        "severity": "MEDIUM",
+        "line": 9,
+        "fileName": "positive3.dockerfile"
       }
     ]

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(query): changed all dockerfile queries for case insensitive support of dockerfile commands #8006

Uh oh!

Diff view

Diff view

There are no files selected for viewing

Uh oh!

Uh oh!

fix(query): changed all dockerfile queries for case insensitive support of dockerfile commands #8006

Are you sure you want to change the base?

Uh oh!

fix(query): changed all dockerfile queries for case insensitive support of dockerfile commands #8006

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

Uh oh!

Uh oh!