fix(query): changed all dockerfile queries for case insensitive support of dockerfile commands

.github/scripts/validate-search-line/validate_search_line.py

@@ -30,6 +30,9 @@ def get_changed_queries():
     dirs = []
     for f in files:
         if f.endswith("/query.rego"):
+            if f.startswith("assets/queries/dockerfile/"):
+                print(f"  [SKIP] {f}: Dockerfile queries do not support searchLine")
+                continue
             dirs.append(REPO_ROOT / Path(f).parent)
     return dirs
 

assets/libraries/dockerfile.rego

@@ -69,4 +69,16 @@ check_multi_stage(imageName, images) {
 
     sortedIndex := sort(unsortedIndex)
     imageName == sortedIndex[minus(count(sortedIndex), 1)].Name
-} 
+}
+
+get_original_from_command(commands) = from_command {
+	commands[i].Cmd == "from"
+	from_command :=  {
+		"Value": substring(commands[i].Original, 0, 4),
+		"LineHint" : commands[i]._kics_line - 1
+	}
+}
+
+add_line_hint(raw_search_key, lineHint) = searchKey {
+	searchKey := sprintf("%s^%d", [raw_search_key, lineHint])
+}

assets/queries/dockerfile/add_instead_of_copy/query.rego

@@ -3,14 +3,16 @@ package Cx
 import data.generic.dockerfile as dockerLib
 
 CxPolicy[result] {
-	resource := input.document[i].command[name][_]
-	resource.Cmd == "add"
+	stage := input.document[i].command[name]
 
-	not dockerLib.arrayContains(resource.Value, {".tar", ".tar."})
+	resource = stage[s]
+	stage[s].Cmd == "add"
+	not dockerLib.arrayContains(stage[s].Value, {".tar", ".tar."})
 
+	from_command := dockerLib.get_original_from_command(stage)
 	result := {
 		"documentId": input.document[i].id,
-		"searchKey": sprintf("FROM={{%s}}.{{%s}}", [name, resource.Original]),
+		"searchKey": dockerLib.add_line_hint(sprintf("%s={{%s}}.{{%s}}", [from_command.Value, name, resource.Original]), from_command.LineHint),
 		"issueType": "IncorrectValue",
 		"keyExpectedValue": sprintf("'COPY' %s", [resource.Value[0]]),
 		"keyActualValue": sprintf("'ADD' %s", [resource.Value[0]]),

assets/queries/dockerfile/add_instead_of_copy/test/negative2.dockerfile

@@ -0,0 +1,10 @@
+from openjdk:10-jdk
+volume /tmp
+arg JAR_FILE
+copy ${JAR_FILE} app.jar
+entrypoint ["java","-Djava.security.egd=file:/dev/./urandom","-jar","/app.jar"]
+add http://source.file/package.file.tar.gz /temp
+run tar -xjf /temp/package.file.tar.gz \
+  && make -C /tmp/package.file \
+  && rm /tmp/ package.file.tar.gz
+# trigger validation

assets/queries/dockerfile/add_instead_of_copy/test/positive2.dockerfile

@@ -0,0 +1,9 @@
+from openjdk:10-jdk
+volume /tmp
+add http://source.file/package.file.tar.gz /temp
+run tar -xjf /temp/package.file.tar.gz \
+  && make -C /tmp/package.file \
+  && rm /tmp/ package.file.tar.gz
+arg JAR_FILE
+add ${JAR_FILE} app.jar
+entrypoint ["java","-Djava.security.egd=file:/dev/./urandom","-jar","/app.jar"]

assets/queries/dockerfile/add_instead_of_copy/test/positive_expected_result.json

@@ -1,7 +1,14 @@
 [
-  {
-    "queryName": "Add Instead of Copy",
-    "severity": "MEDIUM",
-    "line": 8
-  }
-]
+	{
+		"queryName": "Add Instead of Copy",
+		"severity": "MEDIUM",
+		"line": 8,
+		"fileName": "positive1.dockerfile"
+	},
+	{
+		"queryName": "Add Instead of Copy",
+		"severity": "MEDIUM",
+		"line": 8,
+		"fileName": "positive2.dockerfile"
+	}
+]

assets/queries/dockerfile/apk_add_using_local_cache_path/query.rego

@@ -10,9 +10,11 @@ CxPolicy[result] {
 	runCommands := dockerLib.getCommands(command.Value[0])
 	containsApkAddWithoutNoCache(runCommands)
 
+	stage := input.document[i].command[name]
+	from_command := dockerLib.get_original_from_command(stage)
 	result := {
 		"documentId": input.document[i].id,
-		"searchKey": sprintf("FROM={{%s}}.{{%s}}", [name, command.Original]),
+		"searchKey": dockerLib.add_line_hint(sprintf("%s={{%s}}.{{%s}}", [from_command.Value, name, command.Original]), from_command.LineHint),
 		"issueType": "IncorrectValue",
 		"keyExpectedValue": "'RUN' should not contain 'apk add' command without '--no-cache' switch",
 		"keyActualValue": "'RUN' contains 'apk add' command without '--no-cache' switch",

assets/queries/dockerfile/apk_add_using_local_cache_path/test/negative3.dockerfile

@@ -0,0 +1,7 @@
+from gliderlabs/alpine:3.3
+run apk add --no-cache python
+workdir /app
+onbuild COPY . /app
+onbuild RUN virtualenv /env && /env/bin/pip install -r /app/requirements.txt
+expose 8080
+cmd ["/env/bin/python", "main.py"]

assets/queries/dockerfile/apk_add_using_local_cache_path/test/positive3.dockerfile

@@ -0,0 +1,7 @@
+from gliderlabs/alpine:3.3
+run apk add --update-cache python
+workdir /app
+onbuild COPY . /app
+onbuild RUN virtualenv /env && /env/bin/pip install -r /app/requirements.txt
+expose 8080
+cmd ["/env/bin/python", "main.py"]

assets/queries/dockerfile/apk_add_using_local_cache_path/test/positive_expected_result.json

@@ -10,5 +10,11 @@
 		"severity": "INFO",
 		"line": 2,
 		"fileName": "positive2.dockerfile"
+	},
+	{
+		"queryName": "Apk Add Using Local Cache Path",
+		"severity": "INFO",
+		"line": 2,
+		"fileName": "positive3.dockerfile"
 	}
-]
+]

assets/queries/dockerfile/apt_get_install_lists_were_not_deleted/query.rego

@@ -1,5 +1,7 @@
 package Cx
 
+import data.generic.dockerfile as dockerLib
+
 CxPolicy[result] {
 	resource := input.document[i].command[name][_]
 	resource.Cmd == "run"
@@ -10,9 +12,12 @@ CxPolicy[result] {
 
 	not hasClean(resource.Value[0], aptGet[0])
 
+	stage := input.document[i].command[name]
+	from_command := dockerLib.get_original_from_command(stage)
+	run_command := substring(resource.Original, 0, 3)
 	result := {
 		"documentId": input.document[i].id,
-		"searchKey": sprintf("FROM={{%s}}.RUN={{%s}}", [name, commands]),
+		"searchKey": dockerLib.add_line_hint(sprintf("%s={{%s}}.%s={{%s}}", [from_command.Value, name, run_command, commands]), from_command.LineHint),
 		"issueType": "IncorrectValue", #"MissingAttribute" / "RedundantAttribute"
 		"keyExpectedValue": "After using apt-get install, the apt-get lists should be deleted",
 		"keyActualValue": "After using apt-get install, the apt-get lists were not deleted",

assets/queries/dockerfile/apt_get_install_lists_were_not_deleted/test/negative3.dockerfile

@@ -0,0 +1,15 @@
+from busyboxneg1
+run apt-get update && apt-get install --no-install-recommends -y python \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+from busyboxneg2
+run apt-get update && apt-get install --no-install-recommends -y python && apt-get clean
+
+from busyboxneg3
+run apt-get update && apt-get install --no-install-recommends -y python \
+  && apt-get clean
+
+from busyboxneg4
+run apt-get update && apt-get install --no-install-recommends -y python \
+  && rm -rf /var/lib/apt/lists/*

assets/queries/dockerfile/apt_get_install_lists_were_not_deleted/test/positive3.dockerfile

@@ -0,0 +1,14 @@
+from busybox1
+run apt-get update && apt-get install --no-install-recommends -y python
+
+from busybox2
+run apt-get install python
+
+from busybox3
+run apt-get update && apt-get install --no-install-recommends -y python
+run rm -rf /var/lib/apt/lists/*
+
+from busybox4
+run apt-get update && apt-get install --no-install-recommends -y python
+run rm -rf /var/lib/apt/lists/*
+run apt-get clean

assets/queries/dockerfile/apt_get_install_lists_were_not_deleted/test/positive_expected_result.json

@@ -1,32 +1,56 @@
 [
-  {
-    "queryName": "Apt Get Install Lists Were Not Deleted",
-    "severity": "INFO",
-    "line": 2,
-    "fileName": "positive.dockerfile"
-  },
-  {
-    "queryName": "Apt Get Install Lists Were Not Deleted",
-    "severity": "INFO",
-    "line": 5,
-    "fileName": "positive.dockerfile"
-  },
-  {
-    "queryName": "Apt Get Install Lists Were Not Deleted",
-    "severity": "INFO",
-    "line": 8,
-    "fileName": "positive.dockerfile"
-  },
-  {
-    "queryName": "Apt Get Install Lists Were Not Deleted",
-    "severity": "INFO",
-    "line": 12,
-    "fileName": "positive.dockerfile"
-  },
-  {
-    "queryName": "Apt Get Install Lists Were Not Deleted",
-    "severity": "INFO",
-    "line": 2,
-    "fileName": "positive2.dockerfile"
-  }
-]
+	{
+		"queryName": "Apt Get Install Lists Were Not Deleted",
+		"severity": "INFO",
+		"line": 2,
+		"fileName": "positive.dockerfile"
+	},
+	{
+		"queryName": "Apt Get Install Lists Were Not Deleted",
+		"severity": "INFO",
+		"line": 5,
+		"fileName": "positive.dockerfile"
+	},
+	{
+		"queryName": "Apt Get Install Lists Were Not Deleted",
+		"severity": "INFO",
+		"line": 8,
+		"fileName": "positive.dockerfile"
+	},
+	{
+		"queryName": "Apt Get Install Lists Were Not Deleted",
+		"severity": "INFO",
+		"line": 12,
+		"fileName": "positive.dockerfile"
+	},
+	{
+		"queryName": "Apt Get Install Lists Were Not Deleted",
+		"severity": "INFO",
+		"line": 2,
+		"fileName": "positive2.dockerfile"
+	},
+	{
+		"queryName": "Apt Get Install Lists Were Not Deleted",
+		"severity": "INFO",
+		"line": 2,
+		"fileName": "positive3.dockerfile"
+	},
+	{
+		"queryName": "Apt Get Install Lists Were Not Deleted",
+		"severity": "INFO",
+		"line": 5,
+		"fileName": "positive3.dockerfile"
+	},
+	{
+		"queryName": "Apt Get Install Lists Were Not Deleted",
+		"severity": "INFO",
+		"line": 8,
+		"fileName": "positive3.dockerfile"
+	},
+	{
+		"queryName": "Apt Get Install Lists Were Not Deleted",
+		"severity": "INFO",
+		"line": 12,
+		"fileName": "positive3.dockerfile"
+	}
+]

assets/queries/dockerfile/apt_get_install_pin_version_not_defined/query.rego

@@ -18,9 +18,12 @@ CxPolicy[result] {
 	packageName := packages[j]
 	analyzePackages(j, packageName, packages, length)
 
+	stage := input.document[i].command[name]
+	from_command := dockerLib.get_original_from_command(stage)
+	run_command := substring(resource.Original, 0, 3)
 	result := {
 		"documentId": input.document[i].id,
-		"searchKey": sprintf("FROM={{%s}}.RUN={{%s}}", [name, commands]),
+		"searchKey": dockerLib.add_line_hint(sprintf("%s={{%s}}.%s={{%s}}", [from_command.Value, name, run_command, commands]), from_command.LineHint),
 		"searchValue": packageName,
 		"issueType": "MissingAttribute",
 		"keyExpectedValue": sprintf("Package '%s' has version defined", [packageName]),
@@ -44,9 +47,11 @@ CxPolicy[result] {
 	regex.match("^[a-zA-Z]", packageName) == true
 	not dockerLib.withVersion(packageName)
 
+	stage := input.document[i].command[name]
+	from_command := dockerLib.get_original_from_command(stage)
 	result := {
 		"documentId": input.document[i].id,
-		"searchKey": sprintf("FROM={{%s}}.{{%s}}", [name, resource.Original]),
+		"searchKey": dockerLib.add_line_hint(sprintf("%s={{%s}}.{{%s}}", [from_command.Value, name, resource.Original]), from_command.LineHint),
 		"searchValue": packageName,
 		"issueType": "IncorrectValue",
 		"keyExpectedValue": sprintf("Package '%s' has version defined", [packageName]),

assets/queries/dockerfile/apt_get_install_pin_version_not_defined/test/negative4.dockerfile

@@ -0,0 +1,2 @@
+from busybox
+run apt-get install python=2.7

assets/queries/dockerfile/apt_get_install_pin_version_not_defined/test/positive3.dockerfile

@@ -0,0 +1,14 @@
+from busybox
+run apt-get install python
+run ["apt-get", "install", "python"]
+
+from busybox2
+run apt-get install -y -t python
+
+from busybox3
+run apt-get update && apt-get install -y \
+    python-qt4 \
+    python-pyside \
+    python-pip \
+    python3-pip \
+    python3-pyqt5

assets/queries/dockerfile/apt_get_install_pin_version_not_defined/test/positive_expected_result.json

@@ -94,5 +94,53 @@
     "severity": "MEDIUM",
     "line": 9,
     "fileName": "positive2.dockerfile"
+  },
+  {
+    "queryName": "Apt Get Install Pin Version Not Defined",
+    "severity": "MEDIUM",
+    "line": 2,
+    "fileName": "positive3.dockerfile"
+  },
+  {
+    "queryName": "Apt Get Install Pin Version Not Defined",
+    "severity": "MEDIUM",
+    "line": 3,
+    "fileName": "positive3.dockerfile"
+  },
+  {
+    "queryName": "Apt Get Install Pin Version Not Defined",
+    "severity": "MEDIUM",
+    "line": 6,
+    "fileName": "positive3.dockerfile"
+  },
+  {
+    "queryName": "Apt Get Install Pin Version Not Defined",
+    "severity": "MEDIUM",
+    "line": 9,
+    "fileName": "positive3.dockerfile"
+  },
+  {
+    "queryName": "Apt Get Install Pin Version Not Defined",
+    "severity": "MEDIUM",
+    "line": 9,
+    "fileName": "positive3.dockerfile"
+  },
+  {
+    "queryName": "Apt Get Install Pin Version Not Defined",
+    "severity": "MEDIUM",
+    "line": 9,
+    "fileName": "positive3.dockerfile"
+  },
+  {
+    "queryName": "Apt Get Install Pin Version Not Defined",
+    "severity": "MEDIUM",
+    "line": 9,
+    "fileName": "positive3.dockerfile"
+  },
+  {
+    "queryName": "Apt Get Install Pin Version Not Defined",
+    "severity": "MEDIUM",
+    "line": 9,
+    "fileName": "positive3.dockerfile"
   }
 ]