bridgecrewio / checkov

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
https://www.checkov.io/
Apache License 2.0
7.16k stars 1.12k forks source link

fix(dockerfile): Handle heredoc #6828

Closed tsmithv11 closed 1 week ago

tsmithv11 commented 1 week ago

User description

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[//]: # "

PR Title

We use the title to create changelog automatically and therefore only allow specific prefixes
- break:    to indicate a breaking change, this supersedes any of the other types
- feat:     to indicate new features or checks
- fix:      to indicate a bugfix or handling of edge cases of existing checks
- docs:     to indicate an update to our documentation
- chore:    to indicate adjustments to workflow files or dependency updates
- platform: to indicate a change needed for the platform
Each prefix should be accompanied by a scope that specifies the targeted framework. If uncertain, use 'general'.
#    
Allowed prefixs:
ansible|argo|arm|azure|bicep|bitbucket|circleci|cloudformation|dockerfile|github|gha|gitlab|helm|kubernetes|kustomize|openapi|sast|sca|secrets|serverless|terraform|general|graph|terraform_plan|terraform_json
#
ex.
feat(terraform): add CKV_AWS_123 to ensure that VPC Endpoint Service is configured for Manual Acceptance

"

Description

Handle heredoc in Dockerfile

Fixes #5090

Checklist:


Generated description

Below is a concise technical summary of the changes proposed in this PR:

Implement handling of heredoc syntax in Dockerfiles by introducing a new function convert_multiline_commands in parser.py. This function processes Dockerfile content to convert heredoc-style commands into single-line commands. Update tests to verify the new functionality, including a new test case test_runner_multiline in test_runner.py and a sample Dockerfile in resources/multiline_command.

<table><tr><th>Topic</th><th>Details</th><tr><td><a href=https://baz.co/changes/bridgecrewio/checkov/6828?tool=ast&topic=Heredoc+Handling>Heredoc Handling</a>
    </td><td>Handle heredoc syntax in Dockerfiles by converting multiline commands into single-line commands using the <code>convert_multiline_commands</code> function.<details><summary>Modified files (1)</summary><ul><li>checkov/dockerfile/parser.py</li></ul></details><details><summary>Latest Contributors(2)</summary><table><tr><th>Email</th><th>Commit</th><th>Date</th></tr><tr><td>anton.gruebel@gmail.com</td><td>feat-dockerfile-add-Im...</td><td>October 06, 2022</td></tr>
mikeurbanski1@users.no...Use-new-runconfig-endp...February 21, 2022 Testing Enhancements Add test cases to verify the handling of heredoc syntax in Dockerfiles, ensuring the new functionality works as expected.
Modified files (2)
  • tests/dockerfile/test_runner.py
  • tests/dockerfile/resources/multiline_command/Dockerfile
Latest Contributors(2)
EmailCommitDate
49649760+lirshindalman...platform-general-remov...January 28, 2024
ravni@paloaltonetworks...fixing-more-testsOctober 19, 2023
This pull request is reviewed by Baz. Join @tsmithv11 and the rest of your team on (Baz).