Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(misconf): handle heredocs in dockerfile instructions #8284

Merged
merged 2 commits into from
Jan 29, 2025
Merged

fix(misconf): handle heredocs in dockerfile instructions #8284

merged 2 commits into from
Jan 29, 2025

Conversation

nikpivkin
Copy link
Contributor

Description

Heredocs allow redirection of subsequent Dockerfile lines to the input of RUN or COPY commands. Right now, Trivy does not handle heredocs in instructions and only exports the first line as an instruction value:

TRACE | | | Unify {"Cmd": "run", "EndLine": 4, "Flags": [], "JSON": false, "Original": "RUN <<EOF", "Path": "Dockerfile", "Stage": 0, "StartLine": 2, "SubCmd": "", "Value": ["<<EOF"]} = instruction

The following scenarios are taken into account:

  1. If the first line in the heredoc is a shebang, the value of the command is the file containing the contents of the heredoc for execution.
  2. In the case of a simple heredoc, its contents are converted into commands.
  3. In other cases, the heredoc is exported as is.

Example Dockerfile:

FROM alpine:3.21
RUN <<EOF
apk add curl
EOF

Output:

./trivy conf --cache-dir cache --checks-bundle-repository localhost:5111/trivy-checks:latest Dockerfile --trace
2025-01-23T18:24:42+06:00       INFO    [misconfig] Misconfiguration scanning is enabled
2025-01-23T18:24:43+06:00       INFO    Detected config files   num=1
...
AVD-DS-0025 (HIGH): '--no-cache' is missed: apk add curl
═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
You should use 'apk add' with '--no-cache' to clean package cached data and reduce image size.

See https://avd.aquasec.com/misconfig/ds025
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 Dockerfile:2-4
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   2 ┌ RUN <<EOF
   3 │ apk add curl
   4 └ EOF
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Trace:

TRACE | | | Unify {"Cmd": "run", "EndLine": 4, "Flags": [], "JSON": false, "Original": "RUN <<EOF\napk add curl\nEOF", "Path": "Dockerfile", "Stage": 0, "StartLine": 2, "SubCmd": "", "Value": ["apk add curl"]} = instruction

Related issues

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

@nikpivkin nikpivkin marked this pull request as ready for review January 23, 2025 13:55
@nikpivkin nikpivkin requested a review from simar7 as a code owner January 23, 2025 13:55
simar7
simar7 reviewed Jan 24, 2025
View reviewed changes
pkg/iac/scanners/dockerfile/parser/parser_test.go Outdated
Comment on lines 95 to 100
name: "with a shebang",
src: `RUN <<EOF
#!/usr/bin/env python
print("hello world")
EOF`,
expected: "/dev/pipes/EOF",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I read your description for the case when it starts with a shebang, but I don't understand this test case. Why is the expected value the one it is?

simar7
simar7 reviewed Jan 24, 2025
View reviewed changes
pkg/iac/scanners/dockerfile/parser/parser.go Outdated
Comment on lines 122 to 125
// if heredoc contains shebang, docker creates a file with the contents and runs it
if strings.HasPrefix(node.Heredocs[0].Content, "#!") {
return "/dev/pipes/" + node.Heredocs[0].Name
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I understand the test case expectation now but what's the reasoning behind this logic? I'm a little paranoid about processing shebangs, should we just leave them out for our implementation?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The processing of heredoc is taken from https://github.com/moby/buildkit/blob/9a39e2c112b7c98353c27e64602bc08f31fe356e/frontend/dockerfile/dockerfile2llb/convert.go#L1200 . Maybe we really shouldn't handle this case? Should we only extract commands from heredoc, since we work with them in checks, and otherwise export it as it is?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I agree.

@simar7 simar7 self-requested a review January 29, 2025 01:18
@simar7 simar7 added this pull request to the merge queue Jan 29, 2025
Merged via the queue into aquasecurity:main with commit 0a3887c Jan 29, 2025
12 checks passed
@aqua-bot aqua-bot mentioned this pull request Jan 29, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@simar7 simar7 simar7 approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

fix(checks): AVD-DS-0025 does not trigger with heredocs
2 participants
@nikpivkin @simar7