Improve suspicious env checks #5

tspearconquest · 2022-06-22T15:16:12Z

The current check for secrets in the env commands of a Dockerfile can incorrectly flag trivially named variables used in certain image builds such as ENV CC="/usr/bin/clang" as potentially containing a secret.

This is due to the contains() function performing a substring comparison. The string "ACCESS_KEY" which is a member of the secrets_env array contains the string "CC" which causes Dockerfiles using this env variable to be flagged.

This PR improves the suspicious env check by running different checks of the env values and performing some basic parsing of the keys and values to look for anything suspicious while avoiding use of the contains() function

Signed-off-by: Thomas Spear [email protected]

* This improves the suspicious env check by running several checks of the env values and performing some basic parsing of the keys and values to look for anything suspicious while avoiding false positives Signed-off-by: Thomas Spear <[email protected]>

Improve suspicious env checks

6e9258c

* This improves the suspicious env check by running several checks of the env values and performing some basic parsing of the keys and values to look for anything suspicious while avoiding false positives Signed-off-by: Thomas Spear <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Improve suspicious env checks #5

Improve suspicious env checks #5

tspearconquest commented Jun 22, 2022 •

edited

Loading

Improve suspicious env checks #5

Are you sure you want to change the base?

Improve suspicious env checks #5

Conversation

tspearconquest commented Jun 22, 2022 • edited Loading

tspearconquest commented Jun 22, 2022 •

edited

Loading