feat: add a check to detect Dockerfile insecure patterns #1116
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Changes: -Function find_dockerfile_from_job: handles finding Dockerfile inside workflow in 2 cases of workflow jobs: -run and -uses. -Simple DockerNode class, so far it stores mainly the dockerfile path retrieved from workflow -Parsing Dockerfile using dockerfile-parse and RUN instruction commands using bashparser.py -Parsing and storing build commands found in Dockerfiles Signed-off-by: Achraf Maghous <[email protected]>
Changes: -Created security analyzer for Dockerfile following current available literature emphasizing: Use of outdated or insecure base images (FROM) Running containers as root (USER) Copying sensitive files into the image (COPY, ADD) Exposing insecure ports (EXPOSE) Environment variable leaks (ENV) Mounting unsafe host directories (VOLUME) Use of potentially dangerous shell commands (RUN) Signed-off-by: Achraf Maghous <[email protected]>
oracle-contributor-agreement
bot
added
the
OCA Verified
tromai
changed the title
Changes: -Added unit tests handling different Docker files Signed-off-by: Achraf Maghous <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Added a checker for insecure Dockerfile patterns.
Description of changes
Created security analyzer for Dockerfile following current available literature emphasizing:
Related issues
Checklist
verifiedlabel should appear next to all of your commits on GitHub.