diff --git a/README.md b/README.md --- a/README.md +++ b/README.md @@ -121,6 +121,7 @@ | [DL3018](https://github.com/hadolint/hadolint/wiki/DL3018) | Pin versions in apk add. Instead of `apk add ` use `apk add =`. | | [DL3019](https://github.com/hadolint/hadolint/wiki/DL3019) | Use the `--no-cache` switch to avoid the need to use `--update` and remove `/var/cache/apk/*` when done installing packages. | | [DL3020](https://github.com/hadolint/hadolint/wiki/DL3020) | Use `COPY` instead of `ADD` for files and folders. | +| [DL3021](https://github.com/hadolint/hadolint/wiki/DL3021) | `COPY` with more than 2 arguments requires the last argument to end with `/` | | [DL4000](https://github.com/hadolint/hadolint/wiki/DL4000) | MAINTAINER is deprecated. | | [DL4001](https://github.com/hadolint/hadolint/wiki/DL4001) | Either use Wget or Curl but not both. | | [DL4003](https://github.com/hadolint/hadolint/wiki/DL4003) | Multiple `CMD` instructions found. | diff --git a/hadolint.cabal b/hadolint.cabal --- a/hadolint.cabal +++ b/hadolint.cabal @@ -2,10 +2,10 @@ -- -- see: https://github.com/sol/hpack -- --- hash: b7ec9fd2a32901585b1deea9c996ddfae7761f1993dcb550b22499da35d8706a +-- hash: 36374cf97e8c22f6971eb0142316c4cb1e42f9d83fba7b06c6558bb0ce1ccf24 name: hadolint -version: 1.2.6 +version: 1.3.0 synopsis: Dockerfile Linter JavaScript API description: A smarter Dockerfile linter that helps you build best practice Docker images. category: Development diff --git a/src/Hadolint/Rules.hs b/src/Hadolint/Rules.hs --- a/src/Hadolint/Rules.hs +++ b/src/Hadolint/Rules.hs @@ -68,6 +68,7 @@ , shellcheckBash , invalidCmd , copyInsteadAdd + , copyEndingSlash , noRootUser , noCd , noSudo @@ -346,25 +347,20 @@ hasVersionSymbol package = or [s `isInfixOf` package | s <- versionSymbols] versionFixed :: String -> Bool versionFixed package = hasVersionSymbol package || isVersionedGit package - packages :: [String] -> [String] - packages args = concat [filter noOption cmd | cmd <- bashCommands args, isPipInstall cmd] - where - noOption arg = arg `notElem` options - options = - [ "pip" - , "pip2" - , "pip3" - , "install" - , "--user" - , "--disable-pip-version-check" - , "--no-cache-dir" - ] isPipInstall :: [String] -> Bool isPipInstall cmd = ["pip", "install"] `isInfixOf` cmd || ["pip3", "install"] `isInfixOf` cmd || ["pip2", "install"] `isInfixOf` cmd isRecursiveInstall :: [String] -> Bool isRecursiveInstall cmd = ["-r"] `isInfixOf` cmd + -- | Returns all the packages after pip install + packages :: [String] -> [String] + packages args = concat [filter noOption cmd | cmd <- bashCommands args, isPipInstall cmd] + where + noOption arg = arg `notElem` commandName && not (isFlag arg) + commandName = ["pip", "pip2", "pip3", "install"] + isFlag ('-':_) = True + isFlag _ = False {-| Rule for pinning NPM packages to version, tag, or commit @@ -388,8 +384,8 @@ packages :: [String] -> [String] packages args = concat [filter noOption cmd | cmd <- bashCommands args, isNpmInstall cmd] where - noOption arg = arg `notElem` options - options = ["npm", "install", "--global"] + noOption arg = arg `notElem` options && not ("--" `isPrefixOf` arg) + options = ["npm", "install", "-g", "-f"] isNpmInstall :: [String] -> Bool isNpmInstall cmd = ["npm", "install"] `isInfixOf` cmd versionFixed :: String -> Bool @@ -467,6 +463,17 @@ check (Add (AddArgs srcs _ _)) = and [isArchive src || isUrl src | SourcePath src <- toList srcs] check _ = True + +copyEndingSlash = instructionRule code severity message check + where + code = "DL3021" + severity = ErrorC + message = "COPY with more than 2 arguments requires the last argument to end with /" + check (Copy (CopyArgs sources t _ _)) + | length sources > 1 = endsWithSlash t + | otherwise = True + check _ = True + endsWithSlash (TargetPath t) = last t == '/' -- it is safe to use last, as the target is never empty useShell = instructionRule code severity message check where diff --git a/test/Spec.hs b/test/Spec.hs --- a/test/Spec.hs +++ b/test/Spec.hs @@ -129,6 +129,8 @@ ruleCatches pipVersionPinned "RUN pip install MySQL_python" it "pip version pinned" $ ruleCatchesNot pipVersionPinned "RUN pip install MySQL_python==1.2.2" + it "pip version pinned with flag" $ + ruleCatchesNot pipVersionPinned "RUN pip install --ignore-installed MySQL_python==1.2.2" it "pip install git" $ ruleCatchesNot pipVersionPinned @@ -151,15 +153,11 @@ "RUN pip install MySQL_python==1.2.2 --disable-pip-version-check" it "pip install no cache dir" $ ruleCatchesNot pipVersionPinned "RUN pip install MySQL_python==1.2.2 --no-cache-dir" - it "pip install extra argument with '--'" $ - ruleCatches - pipVersionPinned - "RUN pip install MySQL_python==1.2.2 --user --extra-arg" - it "pip install extra argument with '-'" $ - ruleCatches pipVersionPinned "RUN pip install MySQL_python==1.2.2 --user -X" -- describe "npm pinning" $ do it "version pinned in package.json" $ ruleCatchesNot npmVersionPinned "RUN npm install" + it "version pinned in package.json with arguments" $ + ruleCatchesNot npmVersionPinned "RUN npm install --progress=false" it "version pinned" $ ruleCatchesNot npmVersionPinned "RUN npm install express@4.1.1" it "version pinned with scope" $ ruleCatchesNot npmVersionPinned "RUN npm install @myorg/privatepackage@\">=0.1.0\"" @@ -167,6 +165,8 @@ ruleCatchesNot npmVersionPinned "RUN npm install express@\"4.1.1\" sax@0.1.1" it "version pinned with --global" $ ruleCatchesNot npmVersionPinned "RUN npm install --global express@\"4.1.1\"" + it "version pinned with -g" $ + ruleCatchesNot npmVersionPinned "RUN npm install -g express@\"4.1.1\"" it "commit pinned for git+ssh" $ ruleCatchesNot npmVersionPinned @@ -261,6 +261,11 @@ it "add for xz" $ ruleCatchesNot copyInsteadAdd "ADD file.xz /usr/src/app/" it "add for tgz" $ ruleCatchesNot copyInsteadAdd "ADD file.tgz /usr/src/app/" it "add for url" $ ruleCatchesNot copyInsteadAdd "ADD http://file.com /usr/src/app/" + -- + describe "copy last argument" $ do + it "no warn on 2 args" $ ruleCatchesNot copyEndingSlash "COPY foo bar" + it "warn on 3 args" $ ruleCatches copyEndingSlash "COPY foo bar baz" + it "no warn on 3 args" $ ruleCatchesNot copyEndingSlash "COPY foo bar baz/" -- describe "format error" $ it "display error after line pos" $ do