Merge pull request #7164 from Checkmarx/AST-45283-dockerCompose

update(query): add cwe infos to dockerCompose queries
Checkmarx · Sep 20, 2024 · 399513d · 399513d
2 parents 21234ad + e46131f
commit 399513d
Show file tree

Hide file tree

Showing 30 changed files with 177 additions and 136 deletions.
diff --git a/.github/scripts/queries-validator/metadata-schema.json b/.github/scripts/queries-validator/metadata-schema.json
@@ -32,7 +32,8 @@
         "descriptionUrl",
         "cloudProvider",
         "platform",
-        "descriptionID"
+        "descriptionID", 
+        "cwe"
     ],
     "properties": {
         "id": {

diff --git a/README.md b/README.md
@@ -264,7 +264,7 @@ KICS is used by various companies and organizations, some are listed below. If y
 -   [Keptn](https://github.com/keptn) / [Keptn Lifecycle Toolkit](https://keptn.sh)
 
 **Keeping Infrastructure as Code Secure!**
- 
+
 ---
 
-&copy; 2024 Checkmarx Ltd. All Rights Reserved.
+&copy; 2024 Checkmarx Ltd. All Rights Reserved.
diff --git a/assets/queries/dockerCompose/cgroup_not_default/metadata.json b/assets/queries/dockerCompose/cgroup_not_default/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#cgroup_parent",
   "platform": "DockerCompose",
   "descriptionID": "b3657456",
-  "cwe": ""
+  "oldSeverity": "MEDIUM",
+  "cloudProvider": "common",
+  "cwe": "400"
 }
diff --git a/assets/queries/dockerCompose/container_capabilities_unrestricted/metadata.json b/assets/queries/dockerCompose/container_capabilities_unrestricted/metadata.json
@@ -7,6 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#cap_add-cap_drop",
   "platform": "DockerCompose",
   "descriptionID": "1ddab108",
-  "cwe": "",
+  "cloudProvider": "common",
+  "cwe": "400",
   "oldSeverity": "LOW"
 }
diff --git a/assets/queries/dockerCompose/container_traffic_not_bound_to_host_interface/metadata.json b/assets/queries/dockerCompose/container_traffic_not_bound_to_host_interface/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#ports",
   "platform": "DockerCompose",
   "descriptionID": "909d1bcd",
-  "cwe": ""
+  "oldSeverity": "MEDIUM",
+  "cloudProvider": "common",
+  "cwe": "693"
 }
diff --git a/assets/queries/dockerCompose/cpus_not_limited/metadata.json b/assets/queries/dockerCompose/cpus_not_limited/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#resources",
   "platform": "DockerCompose",
   "descriptionID": "d58d94a1",
-  "cwe": ""
+  "oldSeverity": "LOW",
+  "cloudProvider": "common",
+  "cwe": "400"
 }
diff --git a/assets/queries/dockerCompose/default_seccomp_profile_disabled/metadata.json b/assets/queries/dockerCompose/default_seccomp_profile_disabled/metadata.json
@@ -3,9 +3,11 @@
   "queryName": "Default Seccomp Profile Disabled",
   "severity": "MEDIUM",
   "category": "Resource Management",
-  "descriptionText": "Seccomp offers a whitelist of common system calls, blocking all others. Having less kernel exposed to an app then increases security.",
+  "descriptionText": "Seccomp offers a whitelist of common system calls, blocking all others. This reduces the kernel's exposure to the application, thereby increasing security.",
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#security_opt",
   "platform": "DockerCompose",
   "descriptionID": "3702d7fb",
-  "cwe": ""
+  "cloudProvider": "common",
+  "oldSeverity": "MEDIUM",
+  "cwe": "269"
 }
diff --git a/assets/queries/dockerCompose/docker_socket_mounted_in_container/metadata.json b/assets/queries/dockerCompose/docker_socket_mounted_in_container/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/#volumes",
   "platform": "DockerCompose",
   "descriptionID": "8acc9d24",
-  "cwe": ""
+  "oldSeverity": "HIGH",
+  "cloudProvider": "common",
+  "cwe": "284"
 }
diff --git a/assets/queries/dockerCompose/healthcheck_not_set/metadata.json b/assets/queries/dockerCompose/healthcheck_not_set/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#healthcheck",
   "platform": "DockerCompose",
   "descriptionID": "449b7c5c",
-  "cwe": ""
+  "oldSeverity": "MEDIUM",
+  "cloudProvider": "common",
+  "cwe": "703"
 }
diff --git a/assets/queries/dockerCompose/host_namespace_is_shared/metadata.json b/assets/queries/dockerCompose/host_namespace_is_shared/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#pid",
   "platform": "DockerCompose",
   "descriptionID": "39a43177",
-  "cwe": ""
+  "oldSeverity": "MEDIUM",
+  "cloudProvider": "common",
+  "cwe": "250"
 }
diff --git a/assets/queries/dockerCompose/memory_not_limited/metadata.json b/assets/queries/dockerCompose/memory_not_limited/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#resources",
   "platform": "DockerCompose",
   "descriptionID": "8fcb9f7d",
-  "cwe": ""
+  "oldSeverity": "MEDIUM",
+  "cloudProvider": "common",
+  "cwe": "770"
 }
diff --git a/assets/queries/dockerCompose/no_new_privileges_not_set/metadata.json b/assets/queries/dockerCompose/no_new_privileges_not_set/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/engine/reference/run/#security-configuration",
   "platform": "DockerCompose",
   "descriptionID": "be48e182",
-  "cwe": ""
+  "oldSeverity": "HIGH",
+  "cloudProvider": "common",
+  "cwe": "250"
 }
diff --git a/assets/queries/dockerCompose/pids_limit_not_set/metadata.json b/assets/queries/dockerCompose/pids_limit_not_set/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#domainname-hostname-ipc-mac_address-privileged-read_only-shm_size-stdin_open-tty-user-working_dir",
   "platform": "DockerCompose",
   "descriptionID": "2d241407",
-  "cwe": ""
+  "oldSeverity": "MEDIUM",
+  "cloudProvider": "common",
+  "cwe": "770"
 }
diff --git a/assets/queries/dockerCompose/privileged_containers_enabled/metadata.json b/assets/queries/dockerCompose/privileged_containers_enabled/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/#privileged",
   "platform": "DockerCompose",
   "descriptionID": "029f6145",
-  "cwe": ""
+  "oldSeverity": "HIGH",
+  "cloudProvider": "common",
+  "cwe": "250"
 }
diff --git a/assets/queries/dockerCompose/privileged_ports_mapped_in_container/metadata.json b/assets/queries/dockerCompose/privileged_ports_mapped_in_container/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#cap_add-cap_drop",
   "platform": "DockerCompose",
   "descriptionID": "686dd55f",
-  "cwe": ""
+  "cloudProvider": "common",
+  "oldSeverity": "MEDIUM",
+  "cwe": "269"
 }
diff --git a/assets/queries/dockerCompose/restart_policy_on_failure_not_set_to_5/metadata.json b/assets/queries/dockerCompose/restart_policy_on_failure_not_set_to_5/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/config/containers/start-containers-automatically/#use-a-restart-policy",
   "platform": "DockerCompose",
   "descriptionID": "d21fff2e",
-  "cwe": ""
+  "oldSeverity": "MEDIUM",
+  "cloudProvider": "common",
+  "cwe": "693"
 }
diff --git a/assets/queries/dockerCompose/security_opt_not_set/metadata.json b/assets/queries/dockerCompose/security_opt_not_set/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#security_opt",
   "platform": "DockerCompose",
   "descriptionID": "83fb7a65",
-  "cwe": ""
+  "cloudProvider": "common",
+  "oldSeverity": "MEDIUM",
+  "cwe": "693"
 }
diff --git a/assets/queries/dockerCompose/shared_host_ipc_namespace/metadata.json b/assets/queries/dockerCompose/shared_host_ipc_namespace/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#domainname-hostname-ipc-mac_address-privileged-read_only-shm_size-stdin_open-tty-user-working_dir",
   "platform": "DockerCompose",
   "descriptionID": "987dc2d7",
-  "cwe": ""
+  "oldSeverity": "MEDIUM",
+  "cloudProvider": "common",
+  "cwe": "668"
 }
diff --git a/assets/queries/dockerCompose/shared_host_network_namespace/metadata.json b/assets/queries/dockerCompose/shared_host_network_namespace/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#network_mode",
   "platform": "DockerCompose",
   "descriptionID": "25acba10",
-  "cwe": ""
+  "cloudProvider": "common",
+  "oldSeverity": "MEDIUM",
+  "cwe": "668"
 }
diff --git a/assets/queries/dockerCompose/shared_host_user_namespace/metadata.json b/assets/queries/dockerCompose/shared_host_user_namespace/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#userns_mode",
   "platform": "DockerCompose",
   "descriptionID": "b7859ec8",
-  "cwe": ""
+  "oldSeverity": "MEDIUM",
+  "cloudProvider": "common",
+  "cwe": "668"
 }
diff --git a/assets/queries/dockerCompose/shared_volumes_between_containers/metadata.json b/assets/queries/dockerCompose/shared_volumes_between_containers/metadata.json
@@ -6,5 +6,8 @@
     "descriptionText": "Volumes shared between containers can cause data corruption or can be used to share malicious files between containers.",
     "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#volumes",
     "platform": "DockerCompose",
-    "descriptionID": "574aa3ab"
+    "descriptionID": "574aa3ab",
+    "oldSeverity": "INFO",
+    "cloudProvider": "common",
+    "cwe": "693"
 }
diff --git a/assets/queries/dockerCompose/volume_has_sensitive_host_directory/metadata.json b/assets/queries/dockerCompose/volume_has_sensitive_host_directory/metadata.json
@@ -10,4 +10,4 @@
   "oldSeverity": "HIGH",
   "cloudProvider": "common",
   "cwe": "668"
-}
+}
diff --git a/assets/queries/dockerCompose/volume_has_sensitive_host_directory/test/negative2.yaml b/assets/queries/dockerCompose/volume_has_sensitive_host_directory/test/negative2.yaml
@@ -1,5 +1,7 @@
 version: '3'
 
+services:
+    image: docker
 volumes:
   wordpress-db-data:
      driver: local-persist

diff --git a/assets/queries/dockerCompose/volume_has_sensitive_host_directory/test/positive3.yaml b/assets/queries/dockerCompose/volume_has_sensitive_host_directory/test/positive3.yaml
@@ -1,5 +1,7 @@
 version: '3'
 
+services:
+    image: docker
 volumes:
   wordpress-db-data:
      driver: local-persist
@@ -9,4 +11,4 @@ volumes:
   wp-content:
      driver: local-persist
      driver_opts:
-       mountpoint: /var/data
+       mountpoint: /var/data
diff --git a/...ries/dockerCompose/volume_has_sensitive_host_directory/test/positive_expected_result.json b/...ries/dockerCompose/volume_has_sensitive_host_directory/test/positive_expected_result.json
@@ -14,7 +14,7 @@
     {
       "queryName": "Volume Has Sensitive Host Directory",
       "severity": "HIGH",
-      "line": 12,
+      "line": 14,
       "filename": "positive3.yaml"
     },
     {

diff --git a/assets/queries/dockerCompose/volume_mounted_in_multiple_containers/metadata.json b/assets/queries/dockerCompose/volume_mounted_in_multiple_containers/metadata.json
@@ -7,5 +7,7 @@
   "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#volumes",
   "platform": "DockerCompose",
   "descriptionID": "1c7ca167",
-  "cwe": ""
+  "cloudProvider": "common",
+  "oldSeverity": "HIGH",
+  "cwe": "668"
 }
diff --git a/e2e/fixtures/E2E_CLI_096_RESULT.json b/e2e/fixtures/E2E_CLI_096_RESULT.json
@@ -32,6 +32,8 @@
       "query_url": "https://docs.docker.com/compose/compose-file/compose-file-v3/#resources",
       "severity": "MEDIUM",
       "platform": "DockerCompose",
+      "cwe": "770",
+			"cloud_provider": "COMMON",
       "category": "Resource Management",
       "experimental": false,
       "description": "Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than the designated amount of memory",

diff --git a/e2e/fixtures/E2E_CLI_097_RESULT.json b/e2e/fixtures/E2E_CLI_097_RESULT.json
@@ -32,6 +32,8 @@
       "query_url": "https://docs.docker.com/compose/compose-file/compose-file-v3/#resources",
       "severity": "MEDIUM",
       "platform": "DockerCompose",
+      "cwe": "770",
+			"cloud_provider": "COMMON",
       "category": "Resource Management",
       "experimental": false,
       "description": "Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than the designated amount of memory",