Do not parse non-dockerfile (#1583)

* draft * checks/pinned_dependencies.go: added isDockerfiler() checks/pinned_dependencies_test.go: added TestDockerfileInvalidFiles * undo CodeQL Co-authored-by: Naveen <[email protected]>
ossf · Feb 1, 2022 · 86d8281 · 86d8281
1 parent 2d0e538
commit 86d8281
Show file tree

Hide file tree

Showing 2 changed files with 110 additions and 24 deletions.
diff --git a/checks/pinned_dependencies.go b/checks/pinned_dependencies.go
@@ -264,12 +264,27 @@ func testValidateDockerfileIsFreeOfInsecureDownloads(pathfn string,
 	return createReturnForIsDockerfileFreeOfInsecureDownloads(r, dl, err)
 }
 
+func isDockerfile(pathfn string, content []byte) bool {
+	if strings.HasSuffix(pathfn, ".go") ||
+		strings.HasSuffix(pathfn, ".c") ||
+		strings.HasSuffix(pathfn, ".cpp") ||
+		strings.HasSuffix(pathfn, ".rs") ||
+		strings.HasSuffix(pathfn, ".js") ||
+		strings.HasSuffix(pathfn, ".py") ||
+		strings.HasSuffix(pathfn, ".pyc") ||
+		strings.HasSuffix(pathfn, ".java") ||
+		isShellScriptFile(pathfn, content) {
+		return false
+	}
+	return true
+}
+
 func validateDockerfileIsFreeOfInsecureDownloads(pathfn string, content []byte,
 	dl checker.DetailLogger, data fileparser.FileCbData) (bool, error) {
 	pdata := dataAsResultPointer(data)
 
-	// Return early if this is a script, e.g. script_dockerfile_something.sh
-	if isShellScriptFile(pathfn, content) {
+	// Return early if this is not a docker file.
+	if !isDockerfile(pathfn, content) {
 		addPinnedResult(pdata, true)
 		return true, nil
 	}
@@ -347,8 +362,8 @@ func validateDockerfileIsPinned(pathfn string, content []byte,
 	// Dockerfile.aarch64, Dockerfile.template, Dockerfile_template, dockerfile, Dockerfile-name.template
 
 	pdata := dataAsResultPointer(data)
-	// Return early if this is a script, e.g. script_dockerfile_something.sh
-	if isShellScriptFile(pathfn, content) {
+	// Return early if this is not a dockerfile.
+	if !isDockerfile(pathfn, content) {
 		addPinnedResult(pdata, true)
 		return true, nil
 	}

diff --git a/checks/pinned_dependencies_test.go b/checks/pinned_dependencies_test.go
@@ -472,6 +472,77 @@ func TestDockerfilePinningFromLineNumber(t *testing.T) {
 	}
 }
 
+func TestDockerfileInvalidFiles(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		filename string
+		expected bool
+	}{
+		{
+			name:     "dockerfile go",
+			filename: "./testdata/Dockerfile.go",
+			expected: false,
+		},
+		{
+			name:     "dockerfile c",
+			filename: "./testdata/Dockerfile.c",
+			expected: false,
+		},
+		{
+			name:     "dockerfile cpp",
+			filename: "./testdata/Dockerfile.cpp",
+			expected: false,
+		},
+		{
+			name:     "dockerfile rust",
+			filename: "./testdata/Dockerfile.rs",
+			expected: false,
+		},
+		{
+			name:     "dockerfile js",
+			filename: "./testdata/Dockerfile.js",
+			expected: false,
+		},
+		{
+			name:     "dockerfile sh",
+			filename: "./testdata/Dockerfile.sh",
+			expected: false,
+		},
+		{
+			name:     "dockerfile py",
+			filename: "./testdata/Dockerfile.py",
+			expected: false,
+		},
+		{
+			name:     "dockerfile pyc",
+			filename: "./testdata/Dockerfile.pyc",
+			expected: false,
+		},
+		{
+			name:     "dockerfile java",
+			filename: "./testdata/Dockerfile.java",
+			expected: false,
+		},
+		{
+			name:     "dockerfile ",
+			filename: "./testdata/Dockerfile.any",
+			expected: true,
+		},
+	}
+	for _, tt := range tests {
+		tt := tt // Re-initializing variable so it is not changed while executing the closure below
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			var c []byte
+			r := isDockerfile(tt.filename, c)
+			if r != tt.expected {
+				t.Errorf("test failed: %s. Expected %v. Got %v", tt.filename, r, tt.expected)
+			}
+		})
+	}
+}
+
 func TestDockerfileInsecureDownloadsLineNumber(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
@@ -483,26 +554,26 @@ func TestDockerfileInsecureDownloadsLineNumber(t *testing.T) {
 			endLine   uint
 		}
 	}{
-		// {
-		// 	name:     "dockerfile downloads",
-		// 	filename: "./testdata/Dockerfile-download-lines",
-		// 	expected: []struct {
-		// 		snippet   string
-		// 		startLine uint
-		// 		endLine   uint
-		// 	}{
-		// 		{
-		// 			snippet:   "curl bla | bash",
-		// 			startLine: 35,
-		// 			endLine:   36,
-		// 		},
-		// 		{
-		// 			snippet:   "pip install -r requirements.txt",
-		// 			startLine: 41,
-		// 			endLine:   42,
-		// 		},
-		// 	},
-		// },
+		{
+			name:     "dockerfile downloads",
+			filename: "./testdata/Dockerfile-download-lines",
+			expected: []struct {
+				snippet   string
+				startLine uint
+				endLine   uint
+			}{
+				{
+					snippet:   "curl bla | bash",
+					startLine: 35,
+					endLine:   36,
+				},
+				{
+					snippet:   "pip install -r requirements.txt",
+					startLine: 41,
+					endLine:   42,
+				},
+			},
+		},
 		{
 			name:     "dockerfile downloads multi-run",
 			filename: "./testdata/Dockerfile-download-multi-runs",