Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

DL3013: Fix false positives for VCS, http and local path packages (#389) #845

Merged
merged 2 commits into from
Jul 9, 2022
Merged

DL3013: Fix false positives for VCS, http and local path packages (#389) #845

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
603084d
DL3013: Fix false positives for VCS, http and local path packages (#389)
Jan 20, 2022
b670a0f
Fix minor typo in test string
Jun 15, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
39 changes: 37 additions & 2 deletions src/Hadolint/Rule/DL3013.hs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,12 +44,18 @@ dl3013 = simpleRule code severity message check
|| ["."] `isInfixOf` Shell.getArgs cmd

hasBuildConstraint cmd = Shell.hasFlag "constraint" cmd || Shell.hasFlag "c" cmd
versionFixed package = hasVersionSymbol package || isVersionedGit package || isLocalPackage package
isVersionedGit package = "git+http" `Text.isInfixOf` package && "@" `Text.isInfixOf` package
versionFixed package = hasVersionSymbol package
|| isVersionedVcs package
|| isLocalPackage package
|| isNoVcsPathSource package
isVersionedVcs package = isVcs package
&& "@" `Text.isInfixOf` package
versionSymbols = ["==", ">=", "<=", ">", "<", "!=", "~=", "==="]
hasVersionSymbol package = or [s `Text.isInfixOf` package | s <- versionSymbols]
localPackageFileExtensions = [".whl", ".tar.gz"]
isLocalPackage package = or [s `Text.isSuffixOf` package | s <- localPackageFileExtensions]
isNoVcsPathSource package = not (isVcs package) && "/" `Text.isInfixOf` package
isVcs package = any (`Text.isPrefixOf` package) vcsSchemes
{-# INLINEABLE dl3013 #-}

packages :: Shell.Command -> [Text.Text]
Expand Down Expand Up @@ -84,5 +90,34 @@ packages cmd =
]
cmd

-- Supported schemes vcs[+protocol] are found here:
-- https://pip.pypa.io/en/stable/topics/vcs-support/
vcsSchemes :: [Text.Text]
vcsSchemes =
[
"git+file",
"git+https",
"git+ssh",
"git+http",
"git+git",
"git",
"hg+file",
"hg+http",
"hg+https",
"hg+ssh",
"hg+static-http",
"svn",
"svn+svn",
"svn+http",
"svn+https",
"svn+ssh",
"bzr+http",
"bzr+https",
"bzr+ssh",
"bzr+sftp",
"bzr+ftp",
"bzr+lp"
]

stripInstallPrefix :: [Text.Text] -> [Text.Text]
stripInstallPrefix cmd = dropWhile (== "install") (dropWhile (/= "install") cmd)
26 changes: 26 additions & 0 deletions test/Hadolint/Rule/DL3013Spec.hs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,13 +76,39 @@ spec = do
onBuildRuleCatchesNot
"DL3013"
"RUN pip install git+https://github.com/rtfd/r-ext.git@0.6-alpha#egg=r-ext"
ruleCatchesNot
"DL3013"
"RUN pip install git+ssh://github.com/rtfd/r-ext.git@0.6-alpha#egg=r-ext"
onBuildRuleCatchesNot
"DL3013"
"RUN pip install git+ssh://github.com/rtfd/r-ext.git@0.6-alpha#egg=r-ext"
it "pip install unversioned git" $ do
ruleCatches
"DL3013"
"RUN pip install git+https://github.com/rtfd/read-ext.git#egg=read-ext"
onBuildRuleCatches
"DL3013"
"RUN pip install git+https://github.com/rtfd/read-ext.git#egg=read-ext"
ruleCatches
"DL3013"
"RUN pip install git+ssh://github.com/rtfd/read-ext.git#egg=read-ext"
onBuildRuleCatches
"DL3013"
"RUN pip install git+ssh://github.com/rtfd/read-ext.git#egg=read-ext"
it "pip install local dir" $ do
ruleCatchesNot
"DL3013"
"RUN pip install foo/bar"
onBuildRuleCatchesNot
"DL3013"
"RUN pip install foo/bar"
it "pip install https url package" $ do
ruleCatchesNot
"DL3013"
"RUN pip install https://foo.bar/baz.zip"
onBuildRuleCatchesNot
"DL3013"
"RUN pip install https://foo.bar/baz.zip"
it "pip install upper bound" $ do
ruleCatchesNot "DL3013" "RUN pip install 'alabaster>=0.7'"
onBuildRuleCatchesNot "DL3013" "RUN pip install 'alabaster>=0.7'"
Expand Down