diff --git a/assets/queries/dockerCompose/shared_volumes_between_containers/metadata.json b/assets/queries/dockerCompose/shared_volumes_between_containers/metadata.json new file mode 100644 index 00000000000..5a99c3ba493 --- /dev/null +++ b/assets/queries/dockerCompose/shared_volumes_between_containers/metadata.json @@ -0,0 +1,10 @@ +{ + "id": "8c978947-0ff6-485c-b0c2-0bfca6026466", + "queryName": "Shared Volumes Between Containers", + "severity": "INFO", + "category": "Insecure Configurations", + "descriptionText": "Volumes shared between containers can cause data corruption or can be used to share malicious files between containers.", + "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#volumes", + "platform": "DockerCompose", + "descriptionID": "574aa3ab" +} diff --git a/assets/queries/dockerCompose/shared_volumes_between_containers/query.rego b/assets/queries/dockerCompose/shared_volumes_between_containers/query.rego new file mode 100644 index 00000000000..4a09ab6bb6f --- /dev/null +++ b/assets/queries/dockerCompose/shared_volumes_between_containers/query.rego @@ -0,0 +1,48 @@ +package Cx + +import data.generic.common as common_lib + +CxPolicy[result] { + resource := input.document[i] + volumes_shared := resource.volumes + _:= volumes_shared[v1] + service_parameters := resource.services[name] + volumes := service_parameters.volumes + volume2 := volumes[v2] + startswith(volume2, v1) + + result := { + "documentId": sprintf("%s", [resource.id]), + "searchKey": sprintf("services.%s.volumes",[name]), + "issueType": "IncorrectValue", + "keyExpectedValue": "There shouldn't be volumes created and shared between containers", + "keyActualValue": sprintf("Volume %s created and shared between containers", [v1]), + "searchLine": common_lib.build_search_line(["services", name, "volumes", v2], []), + } +} + +CxPolicy[result] { + resource := input.document[i] + service_parameters := resource.services[name] + volumes := service_parameters.volumes + volume := volumes[v] + + dup(resource, name, volume) + + result := { + "documentId": sprintf("%s", [resource.id]), + "searchKey": sprintf("services.%s.volumes",[name]), + "issueType": "IncorrectValue", + "keyExpectedValue": "There shouldn't be volumes shared between containers", + "keyActualValue": sprintf("Volume %s shared between containers", [volume]), + "searchLine": common_lib.build_search_line(["services", name, "volumes", v], []), + } +} + +dup(resource, resource_name, volume_name){ + service_parameters := resource.services[name] + name != resource_name + volumes := service_parameters.volumes + vname := volumes[_] + vname == volume_name +} \ No newline at end of file diff --git a/assets/queries/dockerCompose/shared_volumes_between_containers/test/negative1.yaml b/assets/queries/dockerCompose/shared_volumes_between_containers/test/negative1.yaml new file mode 100644 index 00000000000..3ba3a1fd645 --- /dev/null +++ b/assets/queries/dockerCompose/shared_volumes_between_containers/test/negative1.yaml @@ -0,0 +1,16 @@ +version: "3" + +services: + frontend: + build: frontend + ports: + - "8000:80" + volumes: + - ./logic:/app + + backend: + build: backend + expose: + - 8080 + volumes: + - ./bin:/app \ No newline at end of file diff --git a/assets/queries/dockerCompose/shared_volumes_between_containers/test/positive1.yaml b/assets/queries/dockerCompose/shared_volumes_between_containers/test/positive1.yaml new file mode 100644 index 00000000000..068693e6143 --- /dev/null +++ b/assets/queries/dockerCompose/shared_volumes_between_containers/test/positive1.yaml @@ -0,0 +1,16 @@ +version: "3" + +services: + frontend: + build: frontend + ports: + - "8000:80" + volumes: + - ./logic:/app + + backend: + build: backend + expose: + - 8080 + volumes: + - ./logic:/app \ No newline at end of file diff --git a/assets/queries/dockerCompose/shared_volumes_between_containers/test/positive2.yaml b/assets/queries/dockerCompose/shared_volumes_between_containers/test/positive2.yaml new file mode 100644 index 00000000000..57e9c139b7a --- /dev/null +++ b/assets/queries/dockerCompose/shared_volumes_between_containers/test/positive2.yaml @@ -0,0 +1,20 @@ +version: "3" +services: + app: + build: app + ports: + - "0.0.0.0:80:80" + volumes: + - shared-volume:/app/uploads + depends_on: + - checker + + checker: + build: checker + expose: + - 8080 + volumes: + - shared-volume:/uploads + +volumes: + shared-volume: \ No newline at end of file diff --git a/assets/queries/dockerCompose/shared_volumes_between_containers/test/positive_expected_result.json b/assets/queries/dockerCompose/shared_volumes_between_containers/test/positive_expected_result.json new file mode 100644 index 00000000000..4036243d3a3 --- /dev/null +++ b/assets/queries/dockerCompose/shared_volumes_between_containers/test/positive_expected_result.json @@ -0,0 +1,26 @@ +[ + { + "queryName": "Shared Volumes Between Containers", + "severity": "INFO", + "line": 9, + "filename": "positive1.yaml" + }, + { + "queryName": "Shared Volumes Between Containers", + "severity": "INFO", + "line": 16, + "filename": "positive1.yaml" + }, + { + "queryName": "Shared Volumes Between Containers", + "severity": "INFO", + "line": 8, + "filename": "positive2.yaml" + }, + { + "queryName": "Shared Volumes Between Containers", + "severity": "INFO", + "line": 17, + "filename": "positive2.yaml" + } +]