feat(dockerfile): add Image Referencer for Dockerfile

checkov/common/images/image_referencer.py

@@ -117,11 +117,11 @@ class ImageReferencerMixin:
 
     def check_container_image_references(
         self,
-        graph_connector: DiGraph | None,
         root_path: str | Path | None,
         runner_filter: RunnerFilter,
+        graph_connector: DiGraph | None = None,
         definitions: dict[str, dict[str, Any] | list[dict[str, Any]]] | None = None,
-        definitions_raw: dict[str, list[tuple[int, str]]] | None = None
+        definitions_raw: dict[str, list[tuple[int, str]]] | None = None,
     ) -> Report | None:
         """Tries to find image references in graph based IaC templates"""
         from checkov.common.bridgecrew.platform_integration import bc_integration

checkov/dockerfile/base_registry.py

@@ -1,15 +1,36 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
 from checkov.common.bridgecrew.check_type import CheckType
 from checkov.common.checks.base_check_registry import BaseCheckRegistry
 from checkov.common.models.enums import CheckResult
 
+if TYPE_CHECKING:
+    from dockerfile_parse.parser import _Instruction  # only in extra_stubs
+    from checkov.common.checks.base_check import BaseCheck
+    from checkov.common.typing import _SkippedCheck, _CheckResult
+    from checkov.runner_filter import RunnerFilter
+
 
 class Registry(BaseCheckRegistry):
-    def __init__(self):
+    def __init__(self) -> None:
         super().__init__(CheckType.DOCKERFILE)
 
-    def scan(self, scanned_file, entity, skipped_checks, runner_filter):
+    def extract_entity_details(self, entity: dict[str, Any]) -> tuple[str, str, dict[str, Any]]:
+        # not needed
+        pass
+
+    def scan(
+        self,
+        scanned_file: str,
+        entity: dict[str, list[_Instruction]],
+        skipped_checks: list[_SkippedCheck],
+        runner_filter: RunnerFilter,
+        report_type: str | None = None,
+    ) -> dict[BaseCheck, _CheckResult]:
 
-        results = {}
+        results: "dict[BaseCheck, _CheckResult]" = {}
         if not entity:
             return results
         for instruction, checks in self.checks.items():

checkov/dockerfile/image_referencer/manager.py

@@ -0,0 +1,22 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+from checkov.dockerfile.image_referencer.provider import DockerfileProvider
+
+if TYPE_CHECKING:
+    from checkov.common.images.image_referencer import Image
+
+
+class DockerfileImageReferencerManager:
+    __slots__ = ("definitions",)
+
+    def __init__(self, definitions: dict[str, Any]) -> None:
+        self.definitions = definitions
+
+    def extract_images_from_resources(self) -> list[Image]:
+        provider = DockerfileProvider(definitions=self.definitions)
+
+        images = provider.extract_images_from_resources()
+
+        return images

checkov/dockerfile/image_referencer/provider.py

@@ -0,0 +1,55 @@
+from __future__ import annotations
+
+import os
+from typing import TYPE_CHECKING, Callable, Any
+
+from checkov.common.images.image_referencer import Image
+from checkov.common.util.str_utils import removeprefix
+from checkov.dockerfile.utils import DOCKERFILE_STARTLINE, DOCKERFILE_ENDLINE
+
+if TYPE_CHECKING:
+    from typing_extensions import TypeAlias
+
+_ExtractImagesCallableAlias: TypeAlias = Callable[["dict[str, Any]"], "list[str]"]
+
+
+class DockerfileProvider:
+    __slots__ = ("definitions",)
+
+    def __init__(self, definitions: dict[str, Any]) -> None:
+        self.definitions = definitions
+
+    def extract_images_from_resources(self) -> list[Image]:
+        images = []
+
+        for file_path, config in self.definitions.items():
+            instructions = config.get("FROM")
+            if not isinstance(instructions, list):
+                continue
+
+            # just scan the last one
+            instruction = instructions[-1]
+
+            name = instruction["value"]
+
+            if name.startswith("--platform"):
+                # indicates a multi-platform build, therefore skip it
+                # ex. FROM --platform=$BUILDPLATFORM golang:alpine AS build
+                continue
+
+            if " AS " in name:
+                # indicates a multi-stage build, therefore remove everything starting from AS
+                # ex. FROM amazonlinux:2 as run
+                name = name.split(" AS ")[0]
+
+            images.append(
+                Image(
+                    file_path=file_path,
+                    name=name,
+                    start_line=instruction[DOCKERFILE_STARTLINE] + 1,  # starts with 0
+                    end_line=instruction[DOCKERFILE_ENDLINE] + 1,
+                    related_resource_id=f'{removeprefix(file_path, os.getenv("BC_ROOT_DIR", ""))}.FROM',
+                )
+            )
+
+        return images

checkov/dockerfile/parser.py

@@ -2,22 +2,26 @@
 
 from collections import OrderedDict
 from pathlib import Path
+from typing import TYPE_CHECKING
 
 from dockerfile_parse import DockerfileParser
 from dockerfile_parse.constants import COMMENT_INSTRUCTION
 
 from checkov.common.typing import _SkippedCheck
 from checkov.common.util.suppression import collect_suppressions_for_context
 
+if TYPE_CHECKING:
+    from dockerfile_parse.parser import _Instruction  # only in extra_stubs
 
-def parse(filename: str | Path) -> tuple[dict[str, list[dict[str, int | str]]], list[str]]:
+
+def parse(filename: str | Path) -> tuple[dict[str, list[_Instruction]], list[str]]:
     with open(filename) as dockerfile:
         dfp = DockerfileParser(fileobj=dockerfile)
         return dfp_group_by_instructions(dfp)
 
 
-def dfp_group_by_instructions(dfp: DockerfileParser) -> tuple[dict[str, list[dict[str, int | str]]], list[str]]:
-    result: dict[str, list[dict[str, int | str]]] = OrderedDict()
+def dfp_group_by_instructions(dfp: DockerfileParser) -> tuple[dict[str, list[_Instruction]], list[str]]:
+    result: dict[str, list[_Instruction]] = OrderedDict()
     for instruction in dfp.structure:
         instruction_literal = instruction["instruction"]
         if instruction_literal not in result:
@@ -26,7 +30,7 @@ def dfp_group_by_instructions(dfp: DockerfileParser) -> tuple[dict[str, list[dic
     return result, dfp.lines
 
 
-def collect_skipped_checks(parse_result: dict[str, list[dict[str, int | str]]]) -> list[_SkippedCheck]:
+def collect_skipped_checks(parse_result: dict[str, list[_Instruction]]) -> list[_SkippedCheck]:
     skipped_checks = []
 
     if COMMENT_INSTRUCTION in parse_result:

checkov/dockerfile/runner.py

@@ -2,8 +2,9 @@
 
 import logging
 import os
-from typing import TYPE_CHECKING, Callable
+from typing import TYPE_CHECKING, Callable, Any
 
+from checkov.common.images.image_referencer import ImageReferencerMixin
 from checkov.common.output.record import Record
 from checkov.common.output.report import Report
 from checkov.common.output.extra_resource import ExtraResource
@@ -12,16 +13,20 @@
 from checkov.common.runners.base_runner import BaseRunner, filter_ignored_paths
 from checkov.common.util.dockerfile import is_docker_file
 from checkov.common.typing import _CheckResult
+from checkov.dockerfile.image_referencer.manager import DockerfileImageReferencerManager
 from checkov.dockerfile.parser import parse, collect_skipped_checks
 from checkov.dockerfile.registry import registry
+from checkov.dockerfile.utils import DOCKERFILE_STARTLINE, DOCKERFILE_ENDLINE
 from checkov.runner_filter import RunnerFilter
 
 if TYPE_CHECKING:
-    from checkov.common.parsers.node import DictNode
-    from checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck
+    from dockerfile_parse.parser import _Instruction  # only in extra_stubs
+    from networkx import DiGraph
+    from checkov.common.checks.base_check import BaseCheck
+    from checkov.common.images.image_referencer import Image
 
 
-class Runner(BaseRunner):
+class Runner(ImageReferencerMixin, BaseRunner[None]):
     check_type = CheckType.DOCKERFILE  # noqa: CCE003  # a static attribute
 
     def should_scan_file(self, filename: str) -> bool:
@@ -34,7 +39,7 @@ def run(
         files: list[str] | None = None,
         runner_filter: RunnerFilter | None = None,
         collect_skip_comments: bool = True,
-    ) -> Report:
+    ) -> Report | list[Report]:
         runner_filter = runner_filter or RunnerFilter()
         if not runner_filter.show_progress_bar:
             self.pbar.turn_off_progress_bar()
@@ -88,8 +93,8 @@ def run(
                     if result_configuration:
                         if isinstance(result_configuration, list):
                             for res in result_configuration:
-                                startline = res['startline']
-                                endline = res['endline']
+                                startline = res[DOCKERFILE_STARTLINE]
+                                endline = res[DOCKERFILE_ENDLINE]
                                 result_instruction = res["instruction"]
                                 self.build_record(report,
                                                   definitions_raw,
@@ -101,8 +106,8 @@ def run(
                                                   endline,
                                                   result_instruction)
                         else:
-                            startline = result_configuration['startline']
-                            endline = result_configuration['endline']
+                            startline = result_configuration[DOCKERFILE_STARTLINE]
+                            endline = result_configuration[DOCKERFILE_ENDLINE]
                             result_instruction = result_configuration["instruction"]
                             self.build_record(report,
                                               definitions_raw,
@@ -134,6 +139,22 @@ def run(
 
             self.pbar.update()
         self.pbar.close()
+
+        if runner_filter.run_image_referencer:
+            if files:
+                # 'root_folder' shouldn't be empty to remove the whole path later and only leave the shortened form
+                root_folder = os.path.split(os.path.commonprefix(files))[0]
+
+            image_report = self.check_container_image_references(
+                root_path=root_folder,
+                runner_filter=runner_filter,
+                definitions=definitions,
+            )
+
+            if image_report:
+                # due too many tests failing only return a list, if there is an image report
+                return [report, image_report]
+
         return report
 
     def calc_record_codeblock(
@@ -153,7 +174,7 @@ def build_record(
         definitions_raw: dict[str, list[str]],
         docker_file_path: str,
         file_abs_path: str,
-        check: BaseDockerfileCheck,
+        check: BaseCheck,
         check_result: _CheckResult,
         startline: int,
         endline: int,
@@ -179,11 +200,26 @@ def build_record(
         record.set_guideline(check.guideline)
         report.add_record(record=record)
 
+    def extract_images(
+        self,
+        graph_connector: DiGraph | None = None,
+        definitions: dict[str, dict[str, Any] | list[dict[str, Any]]] | None = None,
+        definitions_raw: dict[str, list[tuple[int, str]]] | None = None
+    ) -> list[Image]:
+        if not definitions:
+            # should not happen
+            return []
+
+        manager = DockerfileImageReferencerManager(definitions=definitions)
+        images = manager.extract_images_from_resources()
+
+        return images
+
 
 def get_files_definitions(
     files: list[str], filepath_fn: Callable[[str], str] | None = None
-) -> tuple[dict[str, DictNode], dict[str, list[str]]]:
-    def _parse_file(file: str) -> tuple[str, tuple[dict[str, list[dict[str, int | str]]], list[str]] | None]:
+) -> tuple[dict[str, dict[str, list[_Instruction]]], dict[str, list[str]]]:
+    def _parse_file(file: str) -> tuple[str, tuple[dict[str, list[_Instruction]], list[str]] | None]:
         try:
             return file, parse(file)
         except TypeError:

checkov/dockerfile/utils.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from typing_extensions import Literal
+
+DOCKERFILE_STARTLINE: Literal["startline"] = "startline"
+DOCKERFILE_ENDLINE: Literal["endline"] = "endline"

extra_stubs/dockerfile_parse/__init__.pyi

@@ -0,0 +1,5 @@
+from .parser import DockerfileParser
+
+__all__ = [
+    "DockerfileParser",
+]

extra_stubs/dockerfile_parse/constants.pyi

@@ -0,0 +1,3 @@
+from typing_extensions import Literal
+
+COMMENT_INSTRUCTION: Literal["COMMENT"]

extra_stubs/dockerfile_parse/parser.pyi

@@ -0,0 +1,29 @@
+from typing import TextIO
+
+from typing_extensions import TypedDict
+
+
+class _Instruction(TypedDict):
+    instruction: str
+    startline: int
+    endline: int
+    content: str
+    value: str
+
+
+class DockerfileParser:
+    def __init__(
+        self,
+        path: str | None = ...,
+        cache_content: bool = ...,
+        env_replace: bool = ...,
+        parent_env: dict[str, str] | None = None,
+        fileobj: TextIO | None = None,
+        build_args: dict[str, str] | None = None,
+    ) -> None: ...
+
+    @property
+    def lines(self) -> list[str]: ...
+
+    @property
+    def structure(self) -> list[_Instruction]: ...

mypy.ini

@@ -1,7 +1,10 @@
 [mypy]
+mypy_path = extra_stubs
+
 files = checkov
 exclude = checkov/(arm|cloudformation|dockerfile|bitbucket_pipelines|helm|kubernetes|kustomize|sca_package|serverless|terraform)
 strict = True
+pretty = True
 disallow_subclassing_any = False
 implicit_reexport = True
 show_error_codes = True