fix(query): improve "last user is root" dockerfile query coverage

assets/queries/dockerfile/last_user_is_root/query.rego

@@ -7,7 +7,7 @@ CxPolicy[result] {
 	dockerLib.check_multi_stage(name, input.document[i].command)
 
 	userCmd := [x | resource[j].Cmd == "user"; x := resource[j]]
-	userCmd[minus(count(userCmd), 1)].Value[0] == ["root","0","root:root","0:0"][_]
+	is_root_user(userCmd[minus(count(userCmd), 1)].Value[0])
 
 	from_command := dockerLib.get_original_from_command(resource)
 	result := {
@@ -18,3 +18,13 @@ CxPolicy[result] {
 		"keyActualValue": "Last User is root",
 	}
 }
+
+# Root privileges come from UID 0 alone - USER <user>:<group>
+is_root_user(value) {
+	split(value, ":")[0] == "root"
+}
+
+# Docker parses numeric users as integers, so "00", "+0" and "-0" also resolve to UID 0
+is_root_user(value) {
+	regex.match(`^[+-]?0+$`, split(value, ":")[0])
+}

assets/queries/dockerfile/last_user_is_root/test/negative4.dockerfile

@@ -0,0 +1,4 @@
+FROM alpine:2.6
+USER root
+RUN npm install
+USER 1000:0

assets/queries/dockerfile/last_user_is_root/test/negative5.dockerfile

@@ -0,0 +1,4 @@
+FROM alpine:2.6
+USER root
+RUN npm install
+USER guest:root

assets/queries/dockerfile/last_user_is_root/test/negative6.dockerfile

@@ -0,0 +1,4 @@
+FROM alpine:2.6
+USER root
+RUN npm install
+USER 01000

assets/queries/dockerfile/last_user_is_root/test/positive10.dockerfile

@@ -0,0 +1,3 @@
+FROM alpine:2.6
+USER 000
+RUN npm install

assets/queries/dockerfile/last_user_is_root/test/positive11.dockerfile

@@ -0,0 +1,3 @@
+FROM alpine:2.6
+USER 00:1000
+RUN npm install

assets/queries/dockerfile/last_user_is_root/test/positive12.dockerfile

@@ -0,0 +1,3 @@
+FROM alpine:2.6
+USER +0:wheel
+RUN npm install

assets/queries/dockerfile/last_user_is_root/test/positive13.dockerfile

@@ -0,0 +1,3 @@
+FROM alpine:2.6
+USER -0
+RUN npm install

assets/queries/dockerfile/last_user_is_root/test/positive5.dockerfile

@@ -1,3 +1,3 @@
-from alpine:2.6
-user root
-run npm install
+FROM alpine:2.6
+USER root:0
+RUN npm install

assets/queries/dockerfile/last_user_is_root/test/positive6.dockerfile

@@ -0,0 +1,3 @@
+FROM alpine:2.6
+USER 0:root
+RUN npm install

assets/queries/dockerfile/last_user_is_root/test/positive7.dockerfile

@@ -0,0 +1,3 @@
+from alpine:2.6
+user root
+run npm install

assets/queries/dockerfile/last_user_is_root/test/positive8.dockerfile

@@ -0,0 +1,3 @@
+FROM alpine:2.6
+USER root:wheel
+RUN npm install

assets/queries/dockerfile/last_user_is_root/test/positive9.dockerfile

@@ -0,0 +1,3 @@
+FROM alpine:2.6
+USER 0:1000
+RUN npm install

assets/queries/dockerfile/last_user_is_root/test/positive_expected_result.json

@@ -1,32 +1,80 @@
 [
-	{
-		"queryName": "Last User Is 'root'",
-		"severity": "HIGH",
-		"line": 2,
-		"fileName": "positive1.dockerfile"
-	},
-	{
-		"queryName": "Last User Is 'root'",
-		"severity": "HIGH",
-		"line": 2,
-		"fileName": "positive2.dockerfile"
-	},
-  {
-		"queryName": "Last User Is 'root'",
-		"severity": "HIGH",
-		"line": 2,
-		"fileName": "positive3.dockerfile"
-	},
-	{
-		"queryName": "Last User Is 'root'",
-		"severity": "HIGH",
-		"line": 2,
-		"fileName": "positive4.dockerfile"
-	},
-  {
-		"queryName": "Last User Is 'root'",
-		"severity": "HIGH",
-		"line": 2,
-		"fileName": "positive5.dockerfile"
-	}
+  {
+    "queryName": "Last User Is 'root'",
+    "severity": "HIGH",
+    "line": 2,
+    "fileName": "positive1.dockerfile"
+  },
+  {
+    "queryName": "Last User Is 'root'",
+    "severity": "HIGH",
+    "line": 2,
+    "fileName": "positive2.dockerfile"
+  },
+  {
+    "queryName": "Last User Is 'root'",
+    "severity": "HIGH",
+    "line": 2,
+    "fileName": "positive3.dockerfile"
+  },
+  {
+    "queryName": "Last User Is 'root'",
+    "severity": "HIGH",
+    "line": 2,
+    "fileName": "positive4.dockerfile"
+  },
+  {
+    "queryName": "Last User Is 'root'",
+    "severity": "HIGH",
+    "line": 2,
+    "fileName": "positive5.dockerfile"
+  },
+  {
+    "queryName": "Last User Is 'root'",
+    "severity": "HIGH",
+    "line": 2,
+    "fileName": "positive6.dockerfile"
+  },
+  {
+    "queryName": "Last User Is 'root'",
+    "severity": "HIGH",
+    "line": 2,
+    "fileName": "positive7.dockerfile"
+  },
+  {
+    "queryName": "Last User Is 'root'",
+    "severity": "HIGH",
+    "line": 2,
+    "fileName": "positive8.dockerfile"
+  },
+  {
+    "queryName": "Last User Is 'root'",
+    "severity": "HIGH",
+    "line": 2,
+    "fileName": "positive9.dockerfile"
+  },
+  {
+    "queryName": "Last User Is 'root'",
+    "severity": "HIGH",
+    "line": 2,
+    "fileName": "positive10.dockerfile"
+  },
+  {
+    "queryName": "Last User Is 'root'",
+    "severity": "HIGH",
+    "line": 2,
+    "fileName": "positive11.dockerfile"
+  },
+  {
+    "queryName": "Last User Is 'root'",
+    "severity": "HIGH",
+    "line": 2,
+    "fileName": "positive12.dockerfile"
+  },
+  {
+    "queryName": "Last User Is 'root'",
+    "severity": "HIGH",
+    "line": 2,
+    "fileName": "positive13.dockerfile"
+  }
 ]