Merge branch 'master' into kics-764

assets/queries/dockerCompose/shared_volumes_between_containers/metadata.json

@@ -0,0 +1,10 @@
+{
+    "id": "8c978947-0ff6-485c-b0c2-0bfca6026466",
+    "queryName": "Shared Volumes Between Containers",
+    "severity": "INFO",
+    "category": "Insecure Configurations",
+    "descriptionText": "Volumes shared between containers can cause data corruption or can be used to share malicious files between containers.",
+    "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#volumes",
+    "platform": "DockerCompose",
+    "descriptionID": "574aa3ab"
+}

assets/queries/dockerCompose/shared_volumes_between_containers/query.rego

@@ -0,0 +1,48 @@
+package Cx
+
+import data.generic.common as common_lib
+
+CxPolicy[result] {
+	resource := input.document[i]
+	volumes_shared := resource.volumes
+	_:= volumes_shared[v1]
+	service_parameters := resource.services[name]
+    volumes := service_parameters.volumes
+    volume2 := volumes[v2]
+	startswith(volume2, v1)
+
+	result := {
+		"documentId": sprintf("%s", [resource.id]),
+		"searchKey": sprintf("services.%s.volumes",[name]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": "There shouldn't be volumes created and shared between containers",
+		"keyActualValue": sprintf("Volume %s created and shared between containers", [v1]),
+		"searchLine": common_lib.build_search_line(["services", name, "volumes", v2], []),
+	}
+}
+
+CxPolicy[result] {
+	resource := input.document[i]
+	service_parameters := resource.services[name]
+    volumes := service_parameters.volumes
+    volume := volumes[v]
+
+    dup(resource, name, volume)
+
+	result := {
+		"documentId": sprintf("%s", [resource.id]),
+		"searchKey": sprintf("services.%s.volumes",[name]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": "There shouldn't be volumes shared between containers",
+		"keyActualValue": sprintf("Volume %s shared between containers", [volume]),
+		"searchLine": common_lib.build_search_line(["services", name, "volumes", v], []),
+	}
+}
+
+dup(resource, resource_name, volume_name){
+	service_parameters := resource.services[name]
+    name != resource_name
+    volumes := service_parameters.volumes
+    vname := volumes[_]
+    vname == volume_name
+}

assets/queries/dockerCompose/shared_volumes_between_containers/test/negative1.yaml

@@ -0,0 +1,16 @@
+version: "3"
+
+services:
+  frontend:
+    build: frontend
+    ports:
+      - "8000:80"
+    volumes:
+        - ./logic:/app
+
+  backend:
+    build: backend
+    expose:
+        - 8080
+    volumes:
+        - ./bin:/app

assets/queries/dockerCompose/shared_volumes_between_containers/test/positive1.yaml

@@ -0,0 +1,16 @@
+version: "3"
+
+services:
+  frontend:
+    build: frontend
+    ports:
+      - "8000:80"
+    volumes:
+        - ./logic:/app
+
+  backend:
+    build: backend
+    expose:
+        - 8080
+    volumes:
+        - ./logic:/app

assets/queries/dockerCompose/shared_volumes_between_containers/test/positive2.yaml

@@ -0,0 +1,20 @@
+version: "3"
+services:
+  app:
+    build: app
+    ports:
+      - "0.0.0.0:80:80"
+    volumes:
+      - shared-volume:/app/uploads
+    depends_on:
+      - checker
+
+  checker:
+    build: checker
+    expose:
+      - 8080
+    volumes:
+      - shared-volume:/uploads
+
+volumes:
+  shared-volume:

assets/queries/dockerCompose/shared_volumes_between_containers/test/positive_expected_result.json

@@ -0,0 +1,26 @@
+[
+    {
+      "queryName": "Shared Volumes Between Containers",
+      "severity": "INFO",
+      "line": 9,
+      "filename": "positive1.yaml"
+    },
+    {
+      "queryName": "Shared Volumes Between Containers",
+      "severity": "INFO",
+      "line": 16,
+      "filename": "positive1.yaml"
+    },
+    {
+      "queryName": "Shared Volumes Between Containers",
+      "severity": "INFO",
+      "line": 8,
+      "filename": "positive2.yaml"
+    },
+    {
+      "queryName": "Shared Volumes Between Containers",
+      "severity": "INFO",
+      "line": 17,
+      "filename": "positive2.yaml"
+    }
+]