Dockerfile metavariables for image aliases are not matching

[minusworld]

Describe the bug
https://semgrep.dev/playground/s/r2c-sec-research-test:missing-image-version

I am trying to update this rule for this issue. I expected the pattern-not-inside clause to filter out the last test case because $ALIAS should match to base, but it does not.

To Reproduce
https://semgrep.dev/playground/s/r2c-sec-research-test:missing-image-version

Expected behavior
I expected the last test case in the example provided to not match.

What is the priority of the bug to you?

• P2: regular bug that should get fixed

Use case
This will help me finish resolving this issue: semgrep/semgrep-rules#2038

[r2c-demo]

This issue is synced in Linear at https://linear.app/r2c/issue/PA-1300/dockerfile-metavariables-for-image-aliases-are-not-matching. Note: this link is for r2c use only and is not accessible publicly.

[stale]

This issue is being marked stale because there hasn't been any activity in 14 days and either it wasn't prioritized or its priority is high. Please apply the appropriate priority:* label before removing the stale label.

[mjambon]

Note that FROM ... doesn't make sense as a pattern because ... would stand for list of items of the same kind. Unfortunately it's not rejected as a syntax error because ... is considered a valid image name. Instead users should write FROM $IMAGE. We probably should do something about this.

The more serious issue here is this:

https://semgrep.dev/playground/s/returntocorp:wtf

Dumping the AST shows the problem:

$ semgrep-core -lang docker -dump_ast <(echo -e 'FROM abcdef')
Pr(
  [ExprStmt(
     Call(
       N(
         Id(("FROM", ()),
           {id_info_id=2; id_hidden=false; id_resolved=Ref(None); id_type=Ref(None); id_svalue=Ref(None); })),
       [Arg(
          Call(
            N(
              Id(("!dockerfile_concat!", ()),
                {id_info_id=1; id_hidden=true; id_resolved=Ref(None); id_type=Ref(None); id_svalue=Ref(None); })),
            [Arg(L(String(("a", ())))); Arg(L(String(("bcdef", ()))))]))]), ())])

The abcdef should be parsed as a single string, not two.