fix(query): fixed query to check more software packages (Checkmarx#4373)

Signed-off-by: Felipe Avelar <[email protected]>
cluetrust · Oct 13, 2021 · fdd7b41 · fdd7b41
1 parent 900315d
commit fdd7b41
Show file tree

Hide file tree

Showing 7 changed files with 45 additions and 11 deletions.
diff --git a/assets/queries/dockerfile/apt_get_missing_yes_flag_to_avoid_manual_input/query.rego b/assets/queries/dockerfile/apt_get_missing_yes_flag_to_avoid_manual_input/query.rego
@@ -8,7 +8,8 @@ CxPolicy[result] {
 
 	count(resource.Value) == 1
 
-	command := resource.Value[j]
+	commands := resource.Value[j]
+	command := split(commands, "&&")[_]
 	isAptGet(command)
 
 	not avoidManualInput(command)
@@ -51,18 +52,14 @@ avoidManualInputInList(command) {
 	contains(command[j], flags[x])
 }
 
-isAptGet(command) {
-	regex.match("apt-get (-(-)?[a-zA-Z]+ *)*install", command)
-}
-
 avoidManualInput(command) {
-	regex.match("apt-get (-(-)?[a-zA-Z]+ *)*(-(q)?y|-yes|--assumeyes) (-(-)?[a-zA-Z]+ *)*install", command)
+	regex.match("apt-get (-(-)?[a-zA-Z]+ *)*(-([A-Za-z])*y|-yes|--assumeyes) (-(-)?[a-zA-Z]+ *)*install", command)
 }
 
 avoidManualInput(command) {
-	regex.match("apt-get (-(-)?[a-zA-Z]+ *)*install (-(-)?[a-zA-Z]+ *)*(-(q)?y|-yes|--assumeyes)", command)
+	regex.match("apt-get (-(-)?[a-zA-Z]+ *)*install (-(-)?[a-zA-Z]+ *)*(-([A-Za-z])*y|-yes|--assumeyes)", command)
 }
 
 avoidManualInput(command) {
-	regex.match("apt-get (-(-)?[a-zA-Z]+ *)*install ([A-Za-z0-9-:=.$_]+ *)*(-(q)?y|-yes|--assumeyes)", command)
+	regex.match("apt-get (-(-)?[a-zA-Z]+ *)*install ([A-Za-z0-9\\W]+ *)*(-([A-Za-z])*y|-yes|--assumeyes)", command)
 }
diff --git a/...oid_manual_input/test/negative.dockerfile → ...id_manual_input/test/negative1.dockerfile b/...oid_manual_input/test/negative.dockerfile → ...id_manual_input/test/negative1.dockerfile
diff --git a/...eries/dockerfile/apt_get_missing_yes_flag_to_avoid_manual_input/test/negative2.dockerfile b/...eries/dockerfile/apt_get_missing_yes_flag_to_avoid_manual_input/test/negative2.dockerfile
@@ -0,0 +1,4 @@
+FROM node:12
+RUN sudo apt-get -y install apt-utils
+RUN sudo apt-get -qy install git gcc
+RUN ["sudo", "apt-get", "-y", "install", "apt-utils"]
diff --git a/...oid_manual_input/test/positive.dockerfile → ...id_manual_input/test/positive1.dockerfile b/...oid_manual_input/test/positive.dockerfile → ...id_manual_input/test/positive1.dockerfile
diff --git a/...eries/dockerfile/apt_get_missing_yes_flag_to_avoid_manual_input/test/positive2.dockerfile b/...eries/dockerfile/apt_get_missing_yes_flag_to_avoid_manual_input/test/positive2.dockerfile
@@ -0,0 +1,4 @@
+FROM node:12
+RUN sudo apt-get install python=2.7
+RUN sudo apt-get install apt-utils
+RUN ["sudo", "apt-get", "install", "apt-utils"]
diff --git a/...eries/dockerfile/apt_get_missing_yes_flag_to_avoid_manual_input/test/positive3.dockerfile b/...eries/dockerfile/apt_get_missing_yes_flag_to_avoid_manual_input/test/positive3.dockerfile
@@ -0,0 +1,2 @@
+FROM node:12
+RUN DUMMY=test apt-get install python=2.7
diff --git a/...kerfile/apt_get_missing_yes_flag_to_avoid_manual_input/test/positive_expected_result.json b/...kerfile/apt_get_missing_yes_flag_to_avoid_manual_input/test/positive_expected_result.json
@@ -2,16 +2,43 @@
   {
     "queryName": "APT-GET Missing '-y' To Avoid Manual Input",
     "severity": "MEDIUM",
-    "line": 2
+    "line": 2,
+    "filename": "positive1.dockerfile"
   },
   {
     "queryName": "APT-GET Missing '-y' To Avoid Manual Input",
     "severity": "MEDIUM",
-    "line": 3
+    "line": 3,
+    "filename": "positive1.dockerfile"
   },
   {
     "queryName": "APT-GET Missing '-y' To Avoid Manual Input",
     "severity": "MEDIUM",
-    "line": 4
+    "line": 4,
+    "filename": "positive1.dockerfile"
+  },
+  {
+    "queryName": "APT-GET Missing '-y' To Avoid Manual Input",
+    "severity": "MEDIUM",
+    "line": 2,
+    "filename": "positive2.dockerfile"
+  },
+  {
+    "queryName": "APT-GET Missing '-y' To Avoid Manual Input",
+    "severity": "MEDIUM",
+    "line": 3,
+    "filename": "positive2.dockerfile"
+  },
+  {
+    "queryName": "APT-GET Missing '-y' To Avoid Manual Input",
+    "severity": "MEDIUM",
+    "line": 4,
+    "filename": "positive2.dockerfile"
+  },
+  {
+    "queryName": "APT-GET Missing '-y' To Avoid Manual Input",
+    "severity": "MEDIUM",
+    "line": 2,
+    "filename": "positive3.dockerfile"
   }
 ]
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		FROM node:12
		RUN DUMMY=test apt-get install python=2.7