Skip to content

Commit 49f0451

Browse files
kdudkakdudka
committed
cstrans-df-run: restrict the regex accepting exec form
... of the RUN instruction. This change causes the following RUN instruction to be recognized as the shell form: ``` RUN [ "$(sha1sum Dockerfile.cached | cut -d' ' -f1)" = "$(sha1sum Dockerfile | cut -d' ' -f1)" ] ``` Fixes: https://issues.redhat.com/browse/PSSECAUT-1207
1 parent 33ed37d commit 49f0451

File tree

5 files changed

+118
-2
lines changed

5 files changed

+118
-2
lines changed

‎src/cstrans-df-run.cc‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -80,8 +80,12 @@ class DockerFileTransformer {
8080
// split RUN directive with options from the actual command
8181
const RE reLineRunOpts_ = RE("^(RUN +(?:--[A-Za-z0-9_]+=[^ ]+ +)*)(.*)$");
8282

83-
/// match ... in RUN [...]
84-
const RE reLineRunExec_ = RE("^\\[(.*)\\] *$");
83+
/// text to construct RE taking "..." where inner quotes can be escaped
84+
const std::string rtQuotedStr_ = "\"([^\"\\\\]|\\\\.)*\"";
85+
86+
/// match RUN ["cmd", "opt1", "opt2", ...] with zero or more opts
87+
const RE reLineRunExec_ = RE("^\\[\\s*(" + rtQuotedStr_
88+
+ "(?:\\s*,\\s*" + rtQuotedStr_ + ")*)\\s*\\]\\s*$");
8589

8690
/// match in-line comments
8791
const RE reComment_ = RE("^\\s*#.*$");

‎tests/cstrans-df-run/0012-sf-stdout.txt‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Detect the drift from the upstream Dockerfile
2+
FROM registry.access.redhat.com/ubi9/ubi-minimal:latest AS drift
3+
WORKDIR /app
4+
COPY drift-cache/Dockerfile Dockerfile.cached
5+
COPY Dockerfile.openshift Dockerfile
6+
# If the command below fails it means that the Dockerfile from this repository changed.
7+
# You have to update the Konflux Containerfile accordingly.
8+
# drift-cache/Dockerfile can be updated with the upstream contents once the Konflux version is aligned.
9+
RUN '/opt/cov-sa-2019.09/bin/cov-build' '--dir=/cov' '--append-log' 'sh' '-c' $'[ \"$(sha1sum Dockerfile.cached | cut -d\' \' -f1)\" = \"$(sha1sum Dockerfile | cut -d\' \' -f1)\" ]'
10+
11+
FROM registry.access.redhat.com/ubi9/go-toolset:1.22 as builder
12+
# dummy copy to trigger the drift detection
13+
COPY --from=drift /app/Dockerfile.cached .
14+
WORKDIR /workspace
15+
# Dummy RUN to create /workspace directory.
16+
# WORKDIR doesn't create the directory (at least for Podman).
17+
# Without this step, the following COPY may create /workspace
18+
# as root-owned (instead of go-toolset's default 1001)
19+
# leading to "Permission denied" errors during "make build"
20+
# when trying to write output.
21+
RUN '/opt/cov-sa-2019.09/bin/cov-build' '--dir=/cov' '--append-log' 'sh' '-c' 'ls .'
22+
COPY . /workspace
23+
RUN '/opt/cov-sa-2019.09/bin/cov-build' '--dir=/cov' '--append-log' 'sh' '-c' 'git config --global --add safe.directory /workspace'
24+
# Build
25+
RUN '/opt/cov-sa-2019.09/bin/cov-build' '--dir=/cov' '--append-log' 'sh' '-c' 'make build'
26+
27+
FROM registry.redhat.io/rhel9-4-els/rhel:9.4-943.1729773477
28+
LABEL maintainer="Red Hat, Inc."
29+
LABEL com.redhat.component="external-dns-container"
30+
LABEL name="external-dns"
31+
LABEL version="1.3.0"
32+
LABEL commit="76d92ad82b22c92c191a8c0145d3712e4012d987"
33+
WORKDIR /
34+
COPY --from=builder /workspace/build/external-dns /
35+
COPY LICENSE /licenses/
36+
USER 65532:65532
37+
ENTRYPOINT ["/external-dns"]

‎tests/cstrans-df-run/0012-stdin.txt‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Detect the drift from the upstream Dockerfile
2+
FROM registry.access.redhat.com/ubi9/ubi-minimal:latest AS drift
3+
WORKDIR /app
4+
COPY drift-cache/Dockerfile Dockerfile.cached
5+
COPY Dockerfile.openshift Dockerfile
6+
# If the command below fails it means that the Dockerfile from this repository changed.
7+
# You have to update the Konflux Containerfile accordingly.
8+
# drift-cache/Dockerfile can be updated with the upstream contents once the Konflux version is aligned.
9+
RUN [ "$(sha1sum Dockerfile.cached | cut -d' ' -f1)" = "$(sha1sum Dockerfile | cut -d' ' -f1)" ]
10+
11+
FROM registry.access.redhat.com/ubi9/go-toolset:1.22 as builder
12+
# dummy copy to trigger the drift detection
13+
COPY --from=drift /app/Dockerfile.cached .
14+
WORKDIR /workspace
15+
# Dummy RUN to create /workspace directory.
16+
# WORKDIR doesn't create the directory (at least for Podman).
17+
# Without this step, the following COPY may create /workspace
18+
# as root-owned (instead of go-toolset's default 1001)
19+
# leading to "Permission denied" errors during "make build"
20+
# when trying to write output.
21+
RUN ls .
22+
COPY . /workspace
23+
RUN git config --global --add safe.directory /workspace
24+
# Build
25+
RUN make build
26+
27+
FROM registry.redhat.io/rhel9-4-els/rhel:9.4-943.1729773477
28+
LABEL maintainer="Red Hat, Inc."
29+
LABEL com.redhat.component="external-dns-container"
30+
LABEL name="external-dns"
31+
LABEL version="1.3.0"
32+
LABEL commit="76d92ad82b22c92c191a8c0145d3712e4012d987"
33+
WORKDIR /
34+
COPY --from=builder /workspace/build/external-dns /
35+
COPY LICENSE /licenses/
36+
USER 65532:65532
37+
ENTRYPOINT ["/external-dns"]

‎tests/cstrans-df-run/0012-stdout.txt‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Detect the drift from the upstream Dockerfile
2+
FROM registry.access.redhat.com/ubi9/ubi-minimal:latest AS drift
3+
WORKDIR /app
4+
COPY drift-cache/Dockerfile Dockerfile.cached
5+
COPY Dockerfile.openshift Dockerfile
6+
# If the command below fails it means that the Dockerfile from this repository changed.
7+
# You have to update the Konflux Containerfile accordingly.
8+
# drift-cache/Dockerfile can be updated with the upstream contents once the Konflux version is aligned.
9+
RUN ["/opt/cov-sa-2019.09/bin/cov-build", "--dir=/cov", "--append-log", "sh", "-c", "[ \"$(sha1sum Dockerfile.cached | cut -d' ' -f1)\" = \"$(sha1sum Dockerfile | cut -d' ' -f1)\" ]"]
10+
11+
FROM registry.access.redhat.com/ubi9/go-toolset:1.22 as builder
12+
# dummy copy to trigger the drift detection
13+
COPY --from=drift /app/Dockerfile.cached .
14+
WORKDIR /workspace
15+
# Dummy RUN to create /workspace directory.
16+
# WORKDIR doesn't create the directory (at least for Podman).
17+
# Without this step, the following COPY may create /workspace
18+
# as root-owned (instead of go-toolset's default 1001)
19+
# leading to "Permission denied" errors during "make build"
20+
# when trying to write output.
21+
RUN ["/opt/cov-sa-2019.09/bin/cov-build", "--dir=/cov", "--append-log", "sh", "-c", "ls ."]
22+
COPY . /workspace
23+
RUN ["/opt/cov-sa-2019.09/bin/cov-build", "--dir=/cov", "--append-log", "sh", "-c", "git config --global --add safe.directory /workspace"]
24+
# Build
25+
RUN ["/opt/cov-sa-2019.09/bin/cov-build", "--dir=/cov", "--append-log", "sh", "-c", "make build"]
26+
27+
FROM registry.redhat.io/rhel9-4-els/rhel:9.4-943.1729773477
28+
LABEL maintainer="Red Hat, Inc."
29+
LABEL com.redhat.component="external-dns-container"
30+
LABEL name="external-dns"
31+
LABEL version="1.3.0"
32+
LABEL commit="76d92ad82b22c92c191a8c0145d3712e4012d987"
33+
WORKDIR /
34+
COPY --from=builder /workspace/build/external-dns /
35+
COPY LICENSE /licenses/
36+
USER 65532:65532
37+
ENTRYPOINT ["/external-dns"]

‎tests/cstrans-df-run/CMakeLists.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,3 +45,4 @@ test_cstrans_df_run(0008)
4545
test_cstrans_df_run(0009)
4646
test_cstrans_df_run(0010)
4747
test_cstrans_df_run(0011)
48+
test_cstrans_df_run(0012)

0 commit comments

Comments
 (0)