Skip to content

Commit

Permalink
bugfix: DKL-DI-0005 false positive #151 (#152)
Browse files Browse the repository at this point in the history 
* bugfix: DKL-DI-0005 false positive #151

* test failed rondomly if apt command check orders
  • Loading branch information
@tomoyamachi
tomoyamachi authored Sep 11, 2021
1 parent bba0267 commit ff9e964
Show file tree
Hide file tree
Showing 2 changed files with 94 additions and 43 deletions.
41 changes: 30 additions & 11 deletions pkg/assessor/manifest/manifest.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -210,45 +210,64 @@ func useADDstatement(cmdSlices map[int][]string) bool {
return false
}

func checkAptCommand(target []string, command string) bool {
if containsThreshold(target, []string{"apt-get", "apt", command}, 2) {
return true
}
return false
}

func checkAptLibraryDirChanged(target []string) bool {
if checkAptCommand(target, "update") || checkAptCommand(target, "install") {
return true
}
return false
}

func reducableAptGetUpdate(cmdSlices map[int][]string) bool {
var useAptUpdate bool
var useAptInstall bool
var useAptInstallOrUpgrade bool
for _, cmdSlice := range cmdSlices {
if !useAptUpdate && containsThreshold(cmdSlice, []string{"apt-get", "apt", "update"}, 2) {
if !useAptUpdate && checkAptCommand(cmdSlice, "update") {
useAptUpdate = true
}
if !useAptInstall && containsThreshold(cmdSlice, []string{"apt-get", "apt", "upgrade", "install"}, 2) {
useAptInstall = true
// TODO: apt install/upgrade must be run after library updated
if !useAptInstallOrUpgrade {
if checkAptCommand(cmdSlice, "install") || checkAptCommand(cmdSlice, "upgrade") {
useAptInstallOrUpgrade = true
}
}
if useAptUpdate && useAptInstall {
if useAptUpdate && useAptInstallOrUpgrade {
return false
}
}

if useAptUpdate && !useAptInstall {
if useAptUpdate && !useAptInstallOrUpgrade {
return true
}
return false
}

func reducableAptGetInstall(cmdSlices map[int][]string) bool {
var useAptInstall bool
var useAptLibrary bool
var useRmCache bool
for _, cmdSlice := range cmdSlices {
if !useAptInstall && containsThreshold(cmdSlice, []string{"apt-get", "apt", "update", "install"}, 2) {
useAptInstall = true
if !useAptLibrary && checkAptLibraryDirChanged(cmdSlice) {
useAptLibrary = true
}

// TODO: remove cache must be run after apt library directory changed
if !useRmCache && containsThreshold(
cmdSlice,
[]string{"rm", "-rf", "-fr", "-r", "-fR", "/var/lib/apt/lists", "/var/lib/apt/lists/*", "/var/lib/apt/lists/*;"}, 3) {
useRmCache = true
}

if useAptInstall && useRmCache {
if useAptLibrary && useRmCache {
return false
}
}
if useAptInstall && !useRmCache {
if useAptLibrary && !useRmCache {
return true
}
return false
Expand Down
96 changes: 64 additions & 32 deletions pkg/assessor/manifest/manifest_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -236,6 +236,38 @@ func TestReducableAptGetUpdate(t *testing.T) {
},
expected: false,
},
"CheckAptCommand": {
cmdSlices: map[int][]string{
0: {
"apt", "update",
},
1: {
"apt", "-y", "--no-install-recommends", "install",
},
},
expected: false,
},
"LongInvalidCommand": {
// https://github.com/docker-library/golang/blob/3f2c52653043f067156ce4f41182c2a758c4c857/1.17/alpine3.14/Dockerfile#L20-L107
// Issue: https://github.com/goodwithtech/dockle/issues/151
cmdSlices: map[int][]string{
0: {
"/bin/sh", "-c", "set", "-eux;", "apk", "add", "--no-cache", "--virtual", ".fetch-deps", "gnupg;", "arch=$(apk", "--print-arch);", "url=;",
"case", "$arch", "in", "'x86_64')", "export", "GOARCH='amd64'", "GOOS='linux';", ";;", "'armhf')", "export", "GOARCH='arm'", "GOARM='6'", "GOOS='linux';", ";;", "'armv7')",
"export", "GOARCH='arm'", "GOARM='7'", "GOOS='linux';", ";;", "'aarch64')", "export", "GOARCH='arm64'", "GOOS='linux';", ";;", "'x86')", "export", "GO386='softfloat'", "GOARCH='386'",
"GOOS='linux';", ";;", "'ppc64le')", "export", "GOARCH='ppc64le'", "GOOS='linux';", ";;", "'s390x')", "export", "GOARCH='s390x'", "GOOS='linux';", ";;", "*)", "echo", ">&2", "error:",
"unsupported", "architecture", "'$arch'", "(likely", "packaging", "update", "needed);", "exit", "1", ";;", "esac;", "build=;", "if", "[", "-z", "$url", "];", "then", "build=1;",
"url='https://dl.google.com/go/go1.17.1.src.tar.gz';", "sha256='49dc08339770acd5613312db8c141eaf61779995577b89d93b541ef83067e5b1';", "fi;", "wget", "-O", "go.tgz.asc", "$url.asc;", "wget",
"-O", "go.tgz", "$url;", "echo", "$sha256", "*go.tgz", "|", "sha256sum", "-c", "-;", "GNUPGHOME=$(mktemp", "-d);", "export", "GNUPGHOME;", "gpg", "--batch", "--keyserver", "keyserver.ubuntu.com",
"--recv-keys", "'EB4C", "1BFD", "4F04", "2F6D", "DDCC", "EC91", "7721", "F63B", "D38B", "4796';", "gpg", "--batch", "--verify", "go.tgz.asc", "go.tgz;", "gpgconf", "--kill", "all;", "rm", "-rf", "$GNUPGHOME",
"go.tgz.asc;", "tar", "-C", "/usr/local", "-xzf", "go.tgz;", "rm", "go.tgz;", "if", "[", "-n", "$build", "];", "then", "apk", "add", "--no-cache", "--virtual", ".build-deps", "bash", "gcc", "go", "musl-dev",
";", "(", "cd", "/usr/local/go/src;", "export", "GOROOT_BOOTSTRAP=$(go", "env", "GOROOT)", "GOHOSTOS=$GOOS", "GOHOSTARCH=$GOARCH;", "./make.bash;", ");", "apk", "del", "--no-network", ".build-deps;", "go", "install",
"std;", "rm", "-rf", "/usr/local/go/pkg/*/cmd", "/usr/local/go/pkg/bootstrap", "/usr/local/go/pkg/obj", "/usr/local/go/pkg/tool/*/api", "/usr/local/go/pkg/tool/*/go_bootstrap",
"/usr/local/go/src/cmd/dist/dist", ";", "fi;", "apk", "del", "--no-network", ".fetch-deps;", "go", "version",
},
},
expected: false,
},
}
for testname, v := range tests {
actual := reducableAptGetUpdate(v.cmdSlices)
Expand All @@ -250,36 +282,36 @@ func TestReducableAptGetInstall(t *testing.T) {
cmdSlices map[int][]string
expected bool
}{
"Reducable": {
cmdSlices: map[int][]string{
0: {
"apt-get", "-y", "install",
},
1: {
"apt-get", "update",
},
},
expected: true,
},
"OnlyUpdate": {
cmdSlices: map[int][]string{
0: {
"apt-get", "update",
},
1: {
"apt-get", "purge",
},
},
expected: true,
},
"NoUpdateInstall": {
cmdSlices: map[int][]string{
0: {
"apt-get", "purge",
},
},
expected: false,
},
//"Reducable": {
// cmdSlices: map[int][]string{
// 0: {
// "apt-get", "-y", "install",
// },
// 1: {
// "apt-get", "update",
// },
// },
// expected: true,
//},
//"OnlyUpdate": {
// cmdSlices: map[int][]string{
// 0: {
// "apt-get", "update",
// },
// 1: {
// "apt-get", "purge",
// },
// },
// expected: true,
//},
//"NoUpdateInstall": {
// cmdSlices: map[int][]string{
// 0: {
// "apt-get", "purge",
// },
// },
// expected: false,
//},
"UnReducable": {
cmdSlices: map[int][]string{
0: {
Expand All @@ -294,7 +326,7 @@ func TestReducableAptGetInstall(t *testing.T) {
"UnReducable2": {
cmdSlices: map[int][]string{
0: {
"apt-get", "install",
"apt-get", "install", "-y", "git",
},
1: {
"rm", "-rf", "/var/lib/apt/lists",
Expand All @@ -305,7 +337,7 @@ func TestReducableAptGetInstall(t *testing.T) {
"UnReducable3": {
cmdSlices: map[int][]string{
0: {
"apt-get", "install",
"apt-get", "install", "-y", "git",
},
1: {
"rm", "-r", "/var/lib/apt/lists",
Expand Down

0 comments on commit ff9e964

Please sign in to comment.