Class: Dash::Dockerfile::Rules::CurlPipeShell

Inherits:
Base
  • Object
show all
Defined in:
lib/dash/dockerfile/rules/curl_pipe_shell.rb

Overview

Piping a download straight into a shell runs whatever the server sends today, and there is no version in the Dockerfile to say what that was.

Constant Summary collapse

SHELL =

sudo may carry flags with or without arguments (-E, -u root) before the shell.

/(?:sudo\s+(?:-\S+(?:\s+[^-\s]\S*)?\s+)*)?(?:ba|z|k)?sh\b/
PIPE_TO_SHELL = 
/\b(?:curl|wget)\b[^|]*\|\s*#{SHELL.source}|#{SHELL.source}\s+<\(\s*(?:curl|wget)\b/
SUGGESTION = 
"download to a file, verify a checksum, then run it — and pin the version"

Instance Method Summary collapse

Instance Method Details

#findings ⇒ Object 



9
10
11
12
13
14
15
 
# File 'lib/dash/dockerfile/rules/curl_pipe_shell.rb', line 9

def findings
  document.instructions.filter_map do |instruction|
    next unless instruction.name == "RUN" && instruction.shell_command.match?(PIPE_TO_SHELL)

    note at(instruction), "a download is piped straight into a shell, so the build runs unverified code", SUGGESTION
  end
end