False Positive: Volume Has Sensitive Host Directory

[rjg21]

Correct me if wrong, but isn't the first sample in the Volume Has Sensitive Host Directory query mounting an anonymous volume? i.e it isn't mounting a host directory at all.

Seems like the query is assuming that after attempting to split on a colon when the volume value doesn't have one that the first part is the host_path when in is actually the path mounted in the container:

kics/assets/queries/dockerCompose/volume_has_sensitive_host_directory/query.rego

Line 11 in 1947496

host_path := path[0]

Was thinking of creating a bug issue but thought I'd just confirm here first.

[rjg21]

#8047 created (eventually)