syncable_cli/analyzer/hadolint/rules/
dl4005.rs

1//! DL4005: Use SHELL to change the default shell
2//!
3//! Instead of using shell commands to change the shell, use the SHELL instruction.
4
5use crate::analyzer::hadolint::parser::instruction::Instruction;
6use crate::analyzer::hadolint::rules::{simple_rule, SimpleRule};
7use crate::analyzer::hadolint::shell::ParsedShell;
8use crate::analyzer::hadolint::types::Severity;
9
10pub fn rule() -> SimpleRule<impl Fn(&Instruction, Option<&ParsedShell>) -> bool + Send + Sync> {
11    simple_rule(
12        "DL4005",
13        Severity::Warning,
14        "Use `SHELL` to change the default shell.",
15        |instr, _shell| {
16            match instr {
17                Instruction::Run(args) => {
18                    let cmd_text = match &args.arguments {
19                        crate::analyzer::hadolint::parser::instruction::Arguments::Text(t) => t.as_str(),
20                        crate::analyzer::hadolint::parser::instruction::Arguments::List(l) => {
21                            if l.is_empty() {
22                                return true;
23                            }
24                            l.first().map(|s| s.as_str()).unwrap_or("")
25                        }
26                    };
27
28                    // Check for commands that try to change shell
29                    !cmd_text.contains("ln -s")
30                        || !cmd_text.contains("/bin/sh")
31                }
32                _ => true,
33            }
34        },
35    )
36}
37
38#[cfg(test)]
39mod tests {
40    use super::*;
41    use crate::analyzer::hadolint::lint::{lint, LintResult};
42    use crate::analyzer::hadolint::config::HadolintConfig;
43
44    fn lint_dockerfile(content: &str) -> LintResult {
45        lint(content, &HadolintConfig::default())
46    }
47
48    #[test]
49    fn test_shell_instruction() {
50        let result = lint_dockerfile("FROM ubuntu:20.04\nSHELL [\"/bin/bash\", \"-c\"]");
51        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL4005"));
52    }
53
54    #[test]
55    fn test_ln_s_shell() {
56        let result = lint_dockerfile("FROM ubuntu:20.04\nRUN ln -s /bin/bash /bin/sh");
57        assert!(result.failures.iter().any(|f| f.code.as_str() == "DL4005"));
58    }
59
60    #[test]
61    fn test_normal_run() {
62        let result = lint_dockerfile("FROM ubuntu:20.04\nRUN echo hello");
63        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL4005"));
64    }
65}
syncable_cli/analyzer/hadolint/rules/dl4005.rs

syncable_cli/analyzer/hadolint/rules/
dl4005.rs
