syncable_cli/analyzer/hadolint/rules/
dl3016.rs

1//! DL3016: Pin versions in npm install
2//!
3//! npm packages should be pinned to specific versions.
4
5use crate::analyzer::hadolint::parser::instruction::Instruction;
6use crate::analyzer::hadolint::rules::{SimpleRule, simple_rule};
7use crate::analyzer::hadolint::shell::ParsedShell;
8use crate::analyzer::hadolint::types::Severity;
9
10pub fn rule() -> SimpleRule<impl Fn(&Instruction, Option<&ParsedShell>) -> bool + Send + Sync> {
11    simple_rule(
12        "DL3016",
13        Severity::Warning,
14        "Pin versions in npm. Instead of `npm install <package>` use `npm install <package>@<version>`.",
15        |instr, shell| {
16            match instr {
17                Instruction::Run(_) => {
18                    if let Some(shell) = shell {
19                        !shell.any_command(|cmd| {
20                            if cmd.name == "npm" && cmd.has_any_arg(&["install", "i"]) {
21                                // Get packages (args after install, excluding flags)
22                                let packages = get_npm_packages(cmd);
23                                // Check if any package is unpinned
24                                packages.iter().any(|pkg| !is_pinned_npm_package(pkg))
25                            } else {
26                                false
27                            }
28                        })
29                    } else {
30                        true
31                    }
32                }
33                _ => true,
34            }
35        },
36    )
37}
38
39/// Extract package names from npm install command
40fn get_npm_packages(cmd: &crate::analyzer::hadolint::shell::Command) -> Vec<&str> {
41    let mut packages = Vec::new();
42    let mut found_install = false;
43
44    for arg in &cmd.arguments {
45        if arg == "install" || arg == "i" {
46            found_install = true;
47            continue;
48        }
49        if found_install && !arg.starts_with('-') {
50            packages.push(arg.as_str());
51        }
52    }
53
54    packages
55}
56
57/// Check if npm package is pinned
58fn is_pinned_npm_package(pkg: &str) -> bool {
59    // Skip scoped packages check - just check if version is present
60    // Pinned formats: package@version, package@^version, package@~version
61    // Also valid: local paths, git URLs, etc.
62
63    // Skip flags
64    if pkg.starts_with('-') {
65        return true;
66    }
67
68    // Local paths are fine
69    if pkg.starts_with('.') || pkg.starts_with('/') || pkg.starts_with("file:") {
70        return true;
71    }
72
73    // Git URLs are fine
74    if pkg.starts_with("git") || pkg.contains("github.com") || pkg.contains("gitlab.com") {
75        return true;
76    }
77
78    // Check for @ version specifier (but not scoped package @org/name)
79    if pkg.contains('@') {
80        let parts: Vec<&str> = pkg.split('@').collect();
81        // Scoped package: @org/name or @org/name@version
82        if pkg.starts_with('@') {
83            // @org/name@version - has 3 parts
84            parts.len() >= 3
85        } else {
86            // name@version - has 2 parts
87            parts.len() >= 2 && !parts[1].is_empty()
88        }
89    } else {
90        false
91    }
92}
93
94#[cfg(test)]
95mod tests {
96    use super::*;
97    use crate::analyzer::hadolint::config::HadolintConfig;
98    use crate::analyzer::hadolint::lint::{LintResult, lint};
99
100    fn lint_dockerfile(content: &str) -> LintResult {
101        lint(content, &HadolintConfig::default())
102    }
103
104    #[test]
105    fn test_npm_install_unpinned() {
106        let result = lint_dockerfile("FROM node:18\nRUN npm install express");
107        assert!(result.failures.iter().any(|f| f.code.as_str() == "DL3016"));
108    }
109
110    #[test]
111    fn test_npm_install_pinned() {
112        let result = lint_dockerfile("FROM node:18\nRUN npm install express@4.18.2");
113        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3016"));
114    }
115
116    #[test]
117    fn test_npm_install_pinned_caret() {
118        let result = lint_dockerfile("FROM node:18\nRUN npm install express@^4.18.0");
119        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3016"));
120    }
121
122    #[test]
123    fn test_npm_ci() {
124        // npm ci uses package-lock.json, so no packages listed
125        let result = lint_dockerfile("FROM node:18\nRUN npm ci");
126        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3016"));
127    }
128
129    #[test]
130    fn test_npm_install_global_unpinned() {
131        let result = lint_dockerfile("FROM node:18\nRUN npm install -g typescript");
132        assert!(result.failures.iter().any(|f| f.code.as_str() == "DL3016"));
133    }
134
135    #[test]
136    fn test_npm_install_global_pinned() {
137        let result = lint_dockerfile("FROM node:18\nRUN npm install -g typescript@5.0.0");
138        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3016"));
139    }
140}
syncable_cli/analyzer/hadolint/rules/dl3016.rs

syncable_cli/analyzer/hadolint/rules/
dl3016.rs
