fix(docker-compose): support files without version

yaml/docker-compose/security/exposing-docker-socket-volume.test.yaml

@@ -264,3 +264,22 @@ services:
     # ruleid: exposing-docker-socket-volume
     volumes:
       - /var/run/docker.sock:/run/docker.sock
+---
+services:
+  versionless:
+    image: alpine:latest
+    # ruleid: exposing-docker-socket-volume
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+---
+name: CI
+on: [push]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    services:
+      docker:
+        image: docker:dind
+        # ok: exposing-docker-socket-volume
+        volumes:
+          - /var/run/docker.sock:/var/run/docker.sock

yaml/docker-compose/security/exposing-docker-socket-volume.yaml

@@ -2,8 +2,15 @@ rules:
 - id: exposing-docker-socket-volume
   patterns:
   - pattern-inside: |
-      version: ...
-      ...
+      services:
+        ...
+  - pattern-not-inside: |
+      jobs:
+        ...
+        $JOB:
+          ...
+          services:
+            ...
   - pattern-either:
     - pattern: |
         volumes:

yaml/docker-compose/security/no-new-privileges.test.yaml

@@ -14,3 +14,18 @@ services:
     security_opt:
       - no-new-privileges:true
       - another-opt:true
+---
+services:
+  # ruleid: no-new-privileges
+  versionless:
+    image: nginx:alpine
+---
+name: CI
+on: [push]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    services:
+      # ok: no-new-privileges
+      postgres:
+        image: postgres:16

yaml/docker-compose/security/no-new-privileges.yaml

@@ -2,10 +2,15 @@ rules:
 - id: no-new-privileges
   patterns:
   - pattern-inside: |
-      version: ...
-      ...
       services:
         ...
+  - pattern-not-inside: |
+      jobs:
+        ...
+        $JOB:
+          ...
+          services:
+            ...
   - pattern: |
       $SERVICE:
         ...

yaml/docker-compose/security/privileged-service.test.yaml

@@ -10,3 +10,20 @@ services:
   # ok: privileged-service
   db:
     image: mysql
+---
+services:
+  versionless:
+    image: alpine:latest
+    # ruleid: privileged-service
+    privileged: true
+---
+name: CI
+on: [push]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    services:
+      docker:
+        image: docker:dind
+        # ok: privileged-service
+        privileged: true

yaml/docker-compose/security/privileged-service.yaml

@@ -2,13 +2,18 @@ rules:
 - id: privileged-service
   patterns:
   - pattern-inside: |
-      version: ...
-      ...
       services:
         ...
         $SERVICE:
           ...
           privileged: $TRUE
+  - pattern-not-inside: |
+      jobs:
+        ...
+        $JOB:
+          ...
+          services:
+            ...
   - focus-metavariable: $TRUE
   - metavariable-regex:
       metavariable: $TRUE

yaml/docker-compose/security/seccomp-confinement-disabled.test.yaml

@@ -13,3 +13,22 @@ services:
     image: mysql
     security_opt:
       - seccomp:unconfined
+---
+services:
+  # ruleid: seccomp-confinement-disabled
+  versionless:
+    image: alpine:latest
+    security_opt:
+      - seccomp:unconfined
+---
+name: CI
+on: [push]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    services:
+      # ok: seccomp-confinement-disabled
+      docker:
+        image: docker:dind
+        security_opt:
+          - seccomp:unconfined

yaml/docker-compose/security/seccomp-confinement-disabled.yaml

@@ -2,10 +2,15 @@ rules:
 - id: seccomp-confinement-disabled
   patterns:
   - pattern-inside: |
-      version: ...
-      ...
       services:
         ...
+  - pattern-not-inside: |
+      jobs:
+        ...
+        $JOB:
+          ...
+          services:
+            ...
   - pattern: |
       $SERVICE:
         ...
@@ -19,7 +24,7 @@ rules:
     the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this.
   metadata:
     cwe:
-    - 'CWE-284: Improper Access Control'
+    - 'CWE-250: Execution with Unnecessary Privileges'
     references:
     - https://docs.docker.com/engine/security/seccomp/
     category: security

yaml/docker-compose/security/selinux-separation-disabled.test.yaml

@@ -13,3 +13,22 @@ services:
     image: mysql
     security_opt:
       - label:disable
+---
+services:
+  # ruleid: selinux-separation-disabled
+  versionless:
+    image: alpine:latest
+    security_opt:
+      - label:disable
+---
+name: CI
+on: [push]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    services:
+      # ok: selinux-separation-disabled
+      docker:
+        image: docker:dind
+        security_opt:
+          - label:disable

yaml/docker-compose/security/selinux-separation-disabled.yaml

@@ -2,10 +2,15 @@ rules:
 - id: selinux-separation-disabled
   patterns:
   - pattern-inside: |
-      version: ...
-      ...
       services:
         ...
+  - pattern-not-inside: |
+      jobs:
+        ...
+        $JOB:
+          ...
+          services:
+            ...
   - pattern: |
       $SERVICE:
         ...
@@ -19,7 +24,7 @@ rules:
     service as an unconfined type. Remove 'label:disable' to prevent this.
   metadata:
     cwe:
-    - 'CWE-284: Improper Access Control'
+    - 'CWE-250: Execution with Unnecessary Privileges'
     references:
     - https://www.projectatomic.io/blog/2016/03/dwalsh_selinux_containers/
     - https://docs.docker.com/engine/reference/run/#security-configuration

yaml/docker-compose/security/writable-filesystem-service.test.yaml

@@ -11,3 +11,18 @@ services:
   db:
     image: mysql
     read_only: true
+---
+services:
+  # ruleid: writable-filesystem-service
+  versionless:
+    image: nginx:alpine
+---
+name: CI
+on: [push]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    services:
+      # ok: writable-filesystem-service
+      postgres:
+        image: postgres:16

yaml/docker-compose/security/writable-filesystem-service.yaml

@@ -2,10 +2,15 @@ rules:
 - id: writable-filesystem-service
   patterns:
   - pattern-inside: |
-      version: ...
-      ...
       services:
         ...
+  - pattern-not-inside: |
+      jobs:
+        ...
+        $JOB:
+          ...
+          services:
+            ...
   - pattern: |
       $SERVICE:
         ...