Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(dockerfile): fix shell_command bash injection #6574

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

faergeek
Copy link
Contributor

@faergeek faergeek commented May 5, 2024

Fixes #6530

@iyzana
Copy link

iyzana commented May 5, 2024

This will also break Dockerfiles that contain the escape directive, for example

# escape=%
FROM scratch
RUN ls %
  --tree

Here the content below shell_command can't be treated as one script. It is interspersed by the Dockerfile line_continuation.

None of the existing injection types are completely correct here. include-children is wrong, because it includes the Dockerfile line_continuations in the script. And combined is wrong, because it treats all RUN statements as one large script.

But I think treating it as one large script is the less bad alternative (if it were to work as intended and didn't have the bug I reported).

@faergeek
Copy link
Contributor Author

faergeek commented May 5, 2024

This will also break Dockerfiles that contain the escape directive, for example

Great point 👍 Though this also doesn't seem to be parsed correctly by dockerfile parser alone, without any injections. From what I see it just seems to stop parsing after %.

@faergeek
Copy link
Contributor Author

faergeek commented May 5, 2024

And it's a known issue camdencheek/tree-sitter-dockerfile#2

@faergeek
Copy link
Contributor Author

Just read a bit more about docker heredocs (never used them myself). They can be used to supply the whole script, but also they can be in the middle of a command like in normal shell scripts. Which means it's not quite right to always inject bash in heredocs, but we have no way to separate those cases. With heredocs in the middle of a command it would be ok to use include-children it seems, but on a shell_fragment, not shell_command.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Dockerfile bash injection is too broad
3 participants