AVD-DS-0031 (leaked secrets) wrongly check fails for every Dockerfile #7825
Closed
pjungermann
started this conversation in
False Detection
Replies: 1 comment 3 replies
-
|
Hi @pjungermann ! A PR is open to fix this problem |
Beta Was this translation helpful? Give feedback.
3 replies
-
|
Perfect, thank you! I was looking for existing issues or PRs, but didn't find that one. |
Beta Was this translation helpful? Give feedback.
-
|
@nikpivkin This is a change of variable names, not a fix, and it doesn’t resolve the underlying issue. |
Beta Was this translation helpful? Give feedback.
-
|
Please see #7828 (comment) |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
IDs
AVD-DS-0031 (DS031)
Description
The leaked secrets check fails for every Dockerfile without any actual matches to the regular expression used.
Excerpt from
-f jsonoutput{ "Type": "Dockerfile Security Check", "ID": "DS031", "AVDID": "AVD-DS-0031", "Title": "Secrets passed via `build-args` or envs or copied secret files", "Description": "Passing secrets via `build-args` or envs or copying secret files can leak them out", "Message": "usr", "Namespace": "builtin.dockerfile.DS031", "Query": "data.builtin.dockerfile.DS031.deny_secrets_tokens", "Resolution": "Use secret mount if secrets are needed during image build. Use volume mount if secret files are needed during container runtime.", "Severity": "CRITICAL", "PrimaryURL": "https://avd.aquasec.com/misconfig/ds031", "References": [ "https://docs.docker.com/build/building/secrets/", "https://avd.aquasec.com/misconfig/ds031" ], "Status": "FAIL", "Layer": {}, "CauseMetadata": { "Provider": "Dockerfile", "Service": "general", "Code": { "Lines": null } } }I used Trivy installed via Homebrew as well as part of megalinter-security executed within Bitbucket Pipelines.
Reproduction Steps
Target
Filesystem
Scanner
Misconfiguration
Target OS
No response
Debug Output
Version
Checklist
-f jsonthat shows data sources and confirmed that the security advisory in data sources was correctBeta Was this translation helpful? Give feedback.
All reactions