validate-dockerfile - npm Package Compare versions

Comparing version 1.7.0 to 1.8.0

index.js

@@ -22,4 +22,4 @@ 'use strict';
   entrypoint: /.+/,
-  add: /^(~?[A-z0-9\/_.-]+|https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{2,256}\.[a-z]{2,6}\b([-a-zA-Z0-9@:%_\+.~#?&\/\/=]*))\s~?[A-z0-9\/_.-]+$/,
-  copy: /^(~?[A-z0-9\/_.-]+|https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{2,256}\.[a-z]{2,6}\b([-a-zA-Z0-9@:%_\+.~#?&\/\/=]*))\s~?[A-z0-9\/_.-]+$/,
+  add: /^((\[\s*\")?~?[A-z0-9\/_.-]+|https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{2,256}\.[a-z]{2,6}\b([-a-zA-Z0-9@:%_\+.~#?&\/\/=]*))(\"\s*,\s*)?\s\"?~?[A-z0-9\/_.-]+(\"\s*\])?$/,
+  copy: /^((\[\s*\")?~?[A-z0-9\/_.-]+|https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{2,256}\.[a-z]{2,6}\b([-a-zA-Z0-9@:%_\+.~#?&\/\/=]*))(\"\s*,\s*)?\s\"?~?[A-z0-9\/_.-]+(\"\s*\])?$/,
   volume: /^~?([A-z0-9\/_.-]+|\[(\s*)?("[A-z0-9\/_. -]+"(,\s*)?)+(\s*)?\])$/,
@@ -29,2 +29,14 @@ workdir: /^~?[A-z0-9\/_.-]+$/
 
+var arrayDisplayed = {
+  initialTestRegex:  /^\[\s*\"/,
+  regex: /(^\[\s*\")([^"]+(\"\s*,\s*\"))*[^"]+(\"\s*\]$)/,
+  isAllowed: {
+    add: true,
+    cmd: true,
+    copy: true,
+    volume: true
+  }
+};
+
+
 function isDirValid (dir) {
@@ -128,2 +140,11 @@ return path.normalize(dir).indexOf('..') !== 0;
       return false;
+    } else if (!opts.quiet && arrayDisplayed.isAllowed[instruction] &&
+        arrayDisplayed.initialTestRegex.test(params) && !arrayDisplayed.regex.test(params)) {
+      // Run the initial test to make sure the array is present first.  Then check that the array
+      // is valid
+      errors.push({
+        message: 'Malformed parameters',
+        line: currentLine,
+        priority: 1
+      });
     }
@@ -130,0 +151,0 @@ if (instruction === 'cmd') {

package.json

 {
   "name": "validate-dockerfile",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Validates a Dockerfile",
@@ -5,0 +5,0 @@ "main": "index.js",

test/main.js

@@ -24,3 +24,3 @@ 'use strict';
         if (!isValid.valid) {
-          counter.next(new Error(isValid.errors[0].message));
+          counter.next(new Error(isValid.errors[0].message + ' ' + isValid.errors[0].line + ' ' + file));
         }
@@ -79,2 +79,37 @@ counter.next();
 
+  it('should complain about bad format of an array', function () {
+    var dockerfile = ['FROM thyferra/bacta',
+      'CMD ["heal, "paitent"]'
+    ].join(EOL);
+
+    var result = validateDockerfile(dockerfile);
+
+    result.should.be.an.Object;
+    result.should.have.property('valid', false);
+    result.should.have.property('errors');
+    result.errors.should.be.an.Array;
+    result.errors.length.should.eql(1);
+    result.errors[0].should.have.property('message', 'Malformed parameters');
+    result.errors[0].should.have.property('line', 2);
+    result.errors[0].should.have.property('priority', 1);
+  });
+
+  it('should complain about bad input in an array', function () {
+    var dockerfile = ['FROM thyferra/bacta',
+      'CMD ["asdfasdf", ""]'
+    ].join(EOL);
+
+    var result = validateDockerfile(dockerfile);
+
+    result.should.be.an.Object;
+    result.should.have.property('valid', false);
+    result.should.have.property('errors');
+    result.errors.should.be.an.Array;
+    result.errors.length.should.eql(1);
+    result.errors[0].should.have.property('message', 'Malformed parameters');
+    result.errors[0].should.have.property('line', 2);
+    result.errors[0].should.have.property('priority', 1);
+  });
+
+
   it('should flunk a file with no FROM', function () {
@@ -81,0 +116,0 @@ var dockerfile = 'Hi mom!';

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Native code

Supply chain risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Found 3 instances in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

75355

increased by73.78%

Number of package files

34

increased by13.33%

Lines of code

623

increased by8.16%

Number of medium supply chain risk alerts

2

decreased by-60%

No dependency changes