Query "Curl or Wget Instead of Add" wrongly detects some filenames as urls

[malte-laukoetter]

Expected Behavior

File names like "httpd-foreground" or "./drop-http-proxy-header.conf" are not detected as URLs.

Actual Behavior

The following ADD statements are wrongly detected as smelly by this query:

ADD ./drop-http-proxy-header.conf /etc/apache2/conf-available

ADD httpd-foreground /usr/local/bin/

The query seems only to check if the sequence "http" or "https" can be found anywhere in the ADD statement not if it is actually an URL. It might be better to check if it also includes :// directly afterward. (see https://github.com/Checkmarx/kics/blob/master/assets/queries/dockerfile/curl_or_wget_instead_of_add/query.rego#L18)

Specifications

• Version: snapshot-34973e9d
• Platform: Docker
• Subsystem: Dockerfiles
• Query: 4b410d24-1cbe-4430-a632-62c9a931cf1c

[cxMiguelSilva]

Hi @Lergin, I hope you are doing Great!!
I am happy to tell you that there is already a PR to improve the RegEx rule in this Security Query.