feat(checks): add secrets leak check in Dockerfile

[nikpivkin]

Close aquasecurity/trivy#7639

The check is triggered in the following cases:

1. Using a secret environment variable in the argument (ARG) or environment variable (ENV).

Dockerfile:

FROM alpine
ARG GITHUB_TOKEN

Output:

CRITICAL: Possible exposure of secret env "GITHUB_TOKEN" in ARG
═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Passing secrets via `build-args` or envs or copying secret files can leak them out

See https://avd.aquasec.com/misconfig/ds031
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 Dockerfile:4
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   4 [ ARG GITHUB_TOKEN
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

2. Copying a secret file, such as an AWS credential file, to an image.

Dockerfile:

FROM alpine
ENV AWS_CONFIG_FILE=/.aws/config
COPY ./config $AWS_CONFIG_FILE

Output:

CRITICAL: Possible exposure of secret file "AWS_CONFIG_FILE" in COPY
═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Passing secrets via `build-args` or envs or copying secret files can leak them out

See https://avd.aquasec.com/misconfig/ds031
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 Dockerfile.dev1:3
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   3 [ COPY ./config $AWS_CONFIG_FILE
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Or

FROM alpine
COPY . .
ENV GOOGLE_APPLICATION_CREDENTIALS="./news-extraction.json"

3. Setting credentials via the setup command.
   Dockerfile:

FROM amazon/aws-cli:latest

RUN aws configure set aws_access_key_id test-id && \
    aws configure set aws_secret_access_key test-key

Output:

CRITICAL: Possible exposure of secret in RUN
═══════════════════════════════════════════════════════════════════════════════════════════════════════════
Passing secrets via `build-args` or envs or copying secret files can leak them out

See https://avd.aquasec.com/misconfig/ds031
───────────────────────────────────────────────────────────────────────────────────────────────────────────
 Dockerfile.dev5:3-4
───────────────────────────────────────────────────────────────────────────────────────────────────────────
   3 ┌ RUN aws configure set aws_access_key_id test-id && \
   4 └     aws configure set aws_secret_access_key test-key
───────────────────────────────────────────────────────────────────────────────────────────────────────────

This ignores the instructions that the secret mount uses:

# syntax=docker/dockerfile:1

FROM python:3.9-slim

RUN apt-get update && apt-get install -y curl unzip \
    && curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" \
    && unzip awscliv2.zip \
    && ./aws/install

RUN --mount=type=secret,id=aws-key-id,env=AWS_ACCESS_KEY_ID \
    --mount=type=secret,id=aws-secret-key,env=AWS_SECRET_ACCESS_KEY \
    aws configure set aws_access_key_id $(cat /run/secrets/aws-key-id) && \
    aws configure set aws_secret_access_key $(cat /run/secrets/aws-secret-key)

[nikpivkin]

@simar7 Do we need to create two separate checks for secret checking and password detection?

[simar7]

Suggested change

	# recommended_action: Use secret mount if secrets are needed during image build. Use volume mount if secret files are needed during container runtime.
	# recommended_action: Use secret mount if secrets are needed during image build. Use volume mount if secured files are needed during container runtime.

[nikpivkin]

why “secured”?

[simar7]

Curious why this change?

[nikpivkin]

This only loads Rego checks.

[simar7]

what's a case that you are thinking to check the args for?

[nikpivkin]

Made it enabled by default 9fc294b

[nikpivkin]

@simar7 Do we need to create two separate checks for secret checking and password detection?

Added this here 5ad893d

[nikpivkin]

@simar7 I added the ability to add custom environment variables to easily extend the check.

❯ cat my-envs.yaml
ds031:
  included_envs: ["MY_SECRET"]

❯ cat Dockerfile.custom
from alpine

arg MY_SECRET

❯ trivy conf -d Dockerfile.custom --config-data my-envs.yaml
CRITICAL: Possible exposure of secret env "MY_SECRET" in ARG
═══════════════════════════════════════════════════════════════════════════════════════════════════════════
Passing secrets via `build-args` or envs or copying secret files can leak them out

See https://avd.aquasec.com/misconfig/ds031
───────────────────────────────────────────────────────────────────────────────────────────────────────────
 Dockerfile.custom:3
───────────────────────────────────────────────────────────────────────────────────────────────────────────
   3 [ arg MY_SECRET
───────────────────────────────────────────────────────────────────────────────────────────────────────────

This can also be implemented for secret tokens if there is a need.

[irbull]

We just got bit flagged by this today. It's not clear why this just happened today as this was merged 2 weeks ago.

However, the URL it suggests to visit for more information, returns a 404: https://avd.aquasec.com/misconfig/ds031.

Is that a separate issue?