Skip to content

fix(query): fix fp for image_version_not_explicit #7561

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cx-artur-ribeiro merged 10 commits into from
Jul 17, 2025
Merged

fix(query): fix fp for image_version_not_explicit #7561

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
eddeacb
fix(query):fix fp for Image_Version_Not_Explicit
cx-andre-pereira Jul 9, 2025
0ac3ed6
Merge https://github.com/cx-andre-pereira/kics into FP_Image_Version_…
cx-andre-pereira Jul 9, 2025
83d9733
test and query update
cx-andre-pereira Jul 9, 2025
36798ce
Merge branch 'master' into FP_Image_Version_Not_Explicit
cx-artur-ribeiro Jul 11, 2025
4ec1ba1
fix typo
cx-andre-pereira Jul 14, 2025
9bc3dbc
Merge branch 'FP_Image_Version_Not_Explicit' of https://github.com/cx…
cx-andre-pereira Jul 14, 2025
906eb0e
fix for clarity/consistency
cx-andre-pereira Jul 14, 2025
f6dcf22
Merge branch 'master' into FP_Image_Version_Not_Explicit
cx-eduardo-semanas Jul 16, 2025
9a86e5e
Merge branch 'master' into AST-100062--FP-Image_Version_Not_Explicit-…
cx-eduardo-semanas Jul 16, 2025
41899f8
Merge branch 'master' into AST-100062--FP-Image_Version_Not_Explicit-…
cx-artur-ribeiro Jul 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions assets/queries/dockerfile/image_version_not_explicit/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ CxPolicy[result] {
resource.Cmd == "from"
not resource.Value[0] == "scratch"

versionNotExplicit(resource.Value)
versionNotExplicit(resource.Value,resource.EndLine)

result := {
"documentId": input.document[i].id,
Expand All @@ -16,13 +16,14 @@ CxPolicy[result] {
}
}

versionNotExplicit(cmd) {
versionNotExplicit(cmd,line) {
count(cmd) == 1
regex.match("^\\$[{}A-z0-9-_+].*", cmd[0]) == false
not contains(cmd[0], ":")
count([x | x := input.document[i].command[name][_]; x.EndLine < line; build_name_exists(x, cmd[0])]) == 0
}

versionNotExplicit(cmd) {
versionNotExplicit(cmd,_) {
count(cmd) == 1
regex.match("^\\$[{}A-z0-9-_+].*", cmd[0]) == true

Expand All @@ -39,11 +40,11 @@ versionNotExplicit(cmd) {
not contains(resource.Value[0], ":")
}

versionNotExplicit(cmd) {
versionNotExplicit(cmd,line) {
count(cmd) > 1

not contains(cmd[0], ":")
count([x | x := input.document[i].command[name][_]; build_name_exists(x, cmd[0])]) == 0
count([x | x := input.document[i].command[name][_]; input.document[i].command[name][_].EndLine < line; build_name_exists(x, cmd[0])]) == 0
}

build_name_exists(resource, build_name){
Expand Down
5 changes: 5 additions & 0 deletions assets/queries/dockerfile/image_version_not_explicit/test/negative3.dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
FROM ubuntu@sha256:b59d21599a2b151e23eea5f6602f4af4d7d31c4e236d22bf0b62b86d2e386b8f as base
RUN echo "base"

FROM base
RUN echo "stage1"
14 changes: 14 additions & 0 deletions assets/queries/dockerfile/image_version_not_explicit/test/negative4.dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
FROM ubuntu:22.04 AS test1
RUN echo "depth1"

FROM test1 AS test2
RUN echo "depth2"

FROM test2 AS test3
RUN echo "depth3"

FROM test3 AS test4
RUN echo "depth4"

FROM test4
RUN echo "depth5"
8 changes: 8 additions & 0 deletions assets/queries/dockerfile/image_version_not_explicit/test/positive3.dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
FROM ubuntu:22.04 AS test
RUN echo "hello"

FROM positive4
RUN echo "positive4"

FROM positive42
RUN echo "positive42"
17 changes: 17 additions & 0 deletions assets/queries/dockerfile/image_version_not_explicit/test/positive4.dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
FROM ubuntu:22.04 AS test1
RUN echo "depth"

FROM test1 AS test2
RUN echo "depth"

FROM test_fail_1
RUN echo "depth"

FROM test3 AS test_fail_2
RUN echo "depth"

FROM test2 AS test3
RUN echo "depth"

FROM test3 AS test_fail_1
RUN echo "depth"
24 changes: 24 additions & 0 deletions assets/queries/dockerfile/image_version_not_explicit/test/positive_expected_result.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,5 +10,29 @@
"severity": "MEDIUM",
"fileName": "positive2.dockerfile",
"line": 7
},
{
"queryName": "Image Version Not Explicit",
"severity": "MEDIUM",
"fileName": "positive3.dockerfile",
"line": 4
},
{
"queryName": "Image Version Not Explicit",
"severity": "MEDIUM",
"fileName": "positive3.dockerfile",
"line": 7
},
{
"queryName": "Image Version Not Explicit",
"severity": "MEDIUM",
"fileName": "positive4.dockerfile",
"line": 7
},
{
"queryName": "Image Version Not Explicit",
"severity": "MEDIUM",
"fileName": "positive4.dockerfile",
"line": 10
}
]
Loading