feat(query): dockerfile Upgrade Instruction Alone

assets/queries/dockerfile/upgrade_instruction_alone/metadata.json

@@ -0,0 +1,10 @@
+{
+  "id": "df87631d-1ebb-45d8-9749-2d2ab2bb92f5",
+  "queryName": "Upgrade Instruction Alone",
+  "severity": "MEDIUM",
+  "category": "Build Process",
+  "descriptionText": "Instruction 'RUN <package> <install>' should always be preceded by '<package> <update>' in the same RUN statement to ensure the package index is up to date before installing packages",
+  "descriptionUrl": "https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#run",
+  "platform": "Dockerfile",
+  "descriptionID": "6959662a"
+}

assets/queries/dockerfile/upgrade_instruction_alone/query.rego

@@ -0,0 +1,119 @@
+package Cx
+
+CxPolicy[result] {
+	resource := input.document[i].command[name][j]
+
+	command := getRunCommand(resource)
+	packages := [l | command[0] == pkg[l]]
+	count(packages) > 0
+	packageManager := pkg[packages[0]]
+	install_position := getDetail(command, pkg_installer[packageManager][_])
+	count(install_position) > 0
+
+	update_data := getMinUpdateCommand(input.document[i], packageManager)
+	not update_before(update_data, j, install_position)
+
+	not checkException(packageManager, command)
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("FROM={{%s}}.RUN={{%s}}", [name, resource.Value[0]]),
+		"issueType": "MissingAttribute",
+		"keyExpectedValue": sprintf("Instruction 'RUN %s %s' should be combined with 'RUN %s %s' ", [packageManager, pkg_installer[packageManager], packageManager, pkg_updater[packageManager]]),
+		"keyActualValue": sprintf("Instruction 'RUN %s %s' isn't combined with 'RUN %s %s in the same 'RUN' statement", [packageManager, pkg_installer[packageManager], packageManager, pkg_updater[packageManager]]),
+	}
+}
+
+CxPolicy[result] {
+	resource := input.document[i].command[name][j]
+
+	command := getRunCommand(resource)
+	packages := [l | command[0] == pkg[l]]
+	count(packages) > 0
+	packageManager := pkg[packages[0]]
+	install_position := getDetail(command, pkg_installer[packageManager][_])
+	count(install_position) > 0
+
+	not getMinUpdateCommand(input.document[i], packageManager)
+	not checkException(packageManager, command)
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("FROM={{%s}}.RUN={{%s}}", [name, resource.Value[0]]),
+		"issueType": "MissingAttribute",
+		"keyExpectedValue": sprintf("Instruction 'RUN %s %s' should be combined with 'RUN %s %s'", [packageManager, pkg_installer[packageManager], packageManager, pkg_updater[packageManager]]),
+		"keyActualValue": sprintf("Instruction 'RUN %s %s' isn't combined with 'RUN %s %s in the same 'RUN' statement", [packageManager, pkg_installer[packageManager], packageManager, pkg_updater[packageManager]]),
+	}
+}
+
+getMinUpdateCommand(document, packageManager) = ans {
+	ans := [x | x := {y: getUpdateCommand(document.command[_][y], packageManager)}][0]
+}
+
+getUpdateCommand(resource, packageManager) = ans {
+	command := getRunCommand(resource)
+	command[0] == packageManager
+	position := getDetail(command, pkg_updater[packageManager][_])
+	count(position) > 0
+	ans := position
+}
+
+pkg := [
+	"apt-get",
+	"apk",
+	"yum",
+	"dnf",
+	"zypper",
+	"pacman",
+	"apt",
+	"pkg_add",
+]
+
+pkg_updater := {
+	"apt-get": ["update"],
+	"apk": ["update"],
+	"yum": ["update"],
+	"dnf": ["update"],
+	"zypper": ["refresh"],
+	"pacman": ["-Syu"],
+	"apt": ["update"],
+}
+
+pkg_installer := {
+	"apt-get": ["install", "source-install", "reinstall"],
+	"apk": ["add"],
+	"yum": ["install"],
+	"dnf": ["install"],
+	"zypper": ["install"],
+	"pacman": ["-S"],
+	"apt": ["install"],
+}
+
+exceptions := {"apk": ["--update", "--update-cache", "-U"]}
+
+getRunCommand(resource) = commandRefactor {
+	resource.Cmd == "run"
+	count(resource.Value) == 1
+	command := resource.Value[0]
+	commandList := split(command, " ")
+	commandRefactor := [x | x := commandList[_]; x != ""]
+}
+
+getDetail(commandRefactor, value) = list {
+	list := [u | commandRefactor[u] == value]
+}
+
+checkException(nextPackageManager, nextCommandRefactor) {
+	exp := exceptions[nextPackageManager]
+	l := [x | x := getDetail(nextCommandRefactor, exp[_]); count(x) > 0]
+	count(l) > 0
+}
+
+update_before(update_date, j, install_position) {
+	update_date[update_line]
+	update_line < j
+} else {
+	update_position := update_date[update_line]
+	update_line == j
+	update_position < install_position
+}

assets/queries/dockerfile/upgrade_instruction_alone/test/negative1.dockerfile

@@ -0,0 +1,8 @@
+FROM ubuntu:18.04
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends mysql-client \
+    && rm -rf /var/lib/apt/lists/*
+RUN apk update \
+    && apk add --no-cache git ca-certificates
+RUN apk --update add easy-rsa
+ENTRYPOINT ["mysql"]

assets/queries/dockerfile/upgrade_instruction_alone/test/negative10.dockerfile

@@ -0,0 +1,6 @@
+FROM alpine:latest
+RUN apk update && apk add nginx
+RUN apk --update-cache add vim
+RUN apk -U add nano
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/upgrade_instruction_alone/test/negative11.dockerfile

@@ -0,0 +1,5 @@
+FROM alpine:latest
+RUN apk --update add nginx
+RUN apk add --update nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/upgrade_instruction_alone/test/negative12.dockerfile

@@ -0,0 +1,6 @@
+FROM ubuntu:18.04
+RUN apt-get update
+RUN apt-get install -y --no-install-recommends mysql-client \
+    && rm -rf /var/lib/apt/lists/*
+RUN apk update
+ENTRYPOINT ["mysql"]

assets/queries/dockerfile/upgrade_instruction_alone/test/negative2.dockerfile

@@ -0,0 +1,4 @@
+FROM ubuntu:18.04
+RUN apt-get update && apt-get install -y netcat \
+    apt-get update && apt-get install -y supervisor
+ENTRYPOINT ["mysql"]

assets/queries/dockerfile/upgrade_instruction_alone/test/negative3.dockerfile

@@ -0,0 +1,8 @@
+FROM ubuntu:16.04
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends zend-server-php-5.6=8.5.17+b19 \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN /usr/local/zend/bin/php -r "readfile('https://getcomposer.org/installer');" | /usr/local/zend/bin/php \
+    && /usr/local/zend/bin/php composer.phar self-update && /usr/local/zend/bin/php composer.phar update

assets/queries/dockerfile/upgrade_instruction_alone/test/negative4.dockerfile

@@ -0,0 +1,4 @@
+FROM archlinux:latest
+RUN pacman -Syu && pacman -S nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/upgrade_instruction_alone/test/negative5.dockerfile

@@ -0,0 +1,5 @@
+FROM ubuntu:18.04
+RUN apt-get update && apt-get install -y --no-install-recommends mysql-client \
+    && rm -rf /var/lib/apt/lists/*
+RUN apk update
+ENTRYPOINT ["mysql"]

assets/queries/dockerfile/upgrade_instruction_alone/test/negative6.dockerfile

@@ -0,0 +1,4 @@
+FROM opensuse:latest
+RUN zypper refresh && zypper install nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/upgrade_instruction_alone/test/negative7.dockerfile

@@ -0,0 +1,4 @@
+FROM debian:latest
+RUN apt update && install nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/upgrade_instruction_alone/test/negative8.dockerfile

@@ -0,0 +1,4 @@
+FROM centos:latest
+RUN yum update && yum install nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/upgrade_instruction_alone/test/negative9.dockerfile

@@ -0,0 +1,4 @@
+FROM fedora:latest
+RUN dnf update && dnf install nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/upgrade_instruction_alone/test/positive1.dockerfile

@@ -0,0 +1,5 @@
+FROM ubuntu:18.04
+RUN yum update
+RUN apt-get install -y --no-install-recommends mysql-client \
+    && rm -rf /var/lib/apt/lists/*
+ENTRYPOINT ["mysql"]

assets/queries/dockerfile/upgrade_instruction_alone/test/positive2.dockerfile

@@ -0,0 +1,4 @@
+FROM opensuse:latest
+RUN zypper install nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/upgrade_instruction_alone/test/positive3.dockerfile

@@ -0,0 +1,4 @@
+FROM debian:latest
+RUN apt install nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/upgrade_instruction_alone/test/positive4.dockerfile

@@ -0,0 +1,5 @@
+FROM centos:latest
+RUN apt update
+RUN yum install nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/upgrade_instruction_alone/test/positive5.dockerfile

@@ -0,0 +1,4 @@
+FROM fedora:latest
+RUN dnf install nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/upgrade_instruction_alone/test/positive6.dockerfile

@@ -0,0 +1,4 @@
+FROM archlinux:latest
+RUN pacman -S nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/upgrade_instruction_alone/test/positive7.dockerfile

@@ -0,0 +1,4 @@
+FROM alpine:latest
+RUN apk add nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/upgrade_instruction_alone/test/positive_expected_result.json

@@ -0,0 +1,44 @@
+[
+  {
+    "queryName": "Upgrade Instruction Alone",
+    "severity": "MEDIUM",
+    "line": 3,
+    "fileName": "positive1.dockerfile"
+  },
+  {
+    "queryName": "Upgrade Instruction Alone",
+    "severity": "MEDIUM",
+    "line": 2,
+    "fileName": "positive2.dockerfile"
+  },
+  {
+    "queryName": "Upgrade Instruction Alone",
+    "severity": "MEDIUM",
+    "line": 2,
+    "fileName": "positive3.dockerfile"
+  },
+  {
+    "queryName": "Upgrade Instruction Alone",
+    "severity": "MEDIUM",
+    "line": 3,
+    "fileName": "positive4.dockerfile"
+  },
+  {
+    "queryName": "Upgrade Instruction Alone",
+    "severity": "MEDIUM",
+    "line": 2,
+    "fileName": "positive5.dockerfile"
+  },
+  {
+    "queryName": "Upgrade Instruction Alone",
+    "severity": "MEDIUM",
+    "line": 2,
+    "fileName": "positive6.dockerfile"
+  },
+  {
+    "queryName": "Upgrade Instruction Alone",
+    "severity": "MEDIUM",
+    "line": 2,
+    "fileName": "positive7.dockerfile"
+  }
+]