AVD-DS-0025 does not trigger with heredocs

[rittneje]

Description

We have Dockerfiles that use heredocs for various purposes, including running apk add. This causes AVD-DS-0025 to stop working.

Desired Behavior

The check ought to work even if we are using a heredoc.

Actual Behavior

Trivy reports nothing.

Reproduction Steps

FROM alpine:3.21
RUN <<EOF
apk add curl
EOF

$ docker run --rm -it -v $PWD:$PWD:ro -w $PWD aquasec/trivy:0.58.2 config Dockerfile
2025-01-23T03:27:16Z    INFO    [misconfig] Misconfiguration scanning is enabled
2025-01-23T03:27:16Z    INFO    [misconfig] Need to update the built-in checks
2025-01-23T03:27:16Z    INFO    [misconfig] Downloading the built-in checks...
164.50 KiB / 164.50 KiB [---------------------------------------------------------------------------------------------------------------------------------------] 100.00% ? p/s 100ms
2025-01-23T03:27:18Z    INFO    Detected config files   num=1

Target

Filesystem

Scanner

Misconfiguration

Output Format

None

Mode

Standalone

Debug Output

2025-01-23T03:27:40Z    DEBUG   No plugins loaded
2025-01-23T03:27:40Z    DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2025-01-23T03:27:40Z    DEBUG   Cache dir       dir="/root/.cache/trivy"
2025-01-23T03:27:40Z    DEBUG   Cache dir       dir="/root/.cache/trivy"
2025-01-23T03:27:40Z    DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-01-23T03:27:40Z    INFO    [misconfig] Misconfiguration scanning is enabled
2025-01-23T03:27:40Z    DEBUG   [misconfig] Failed to open the check metadata   err="open /root/.cache/trivy/policy/metadata.json: no such file or directory"
2025-01-23T03:27:40Z    INFO    [misconfig] Need to update the built-in checks
2025-01-23T03:27:40Z    INFO    [misconfig] Downloading the built-in checks...
2025-01-23T03:27:40Z    DEBUG   [misconfig] Loading check bundle        repository="mirror.gcr.io/aquasec/trivy-checks:1"
164.50 KiB / 164.50 KiB [---------------------------------------------------------------------------------------------------------------------------------------] 100.00% ? p/s 100ms
2025-01-23T03:27:41Z    DEBUG   [misconfig] Digest of the built-in checks       digest="sha256:550f6438225e011fb3b3f0895c1cb93477e81898210af8e9a184644cb7295b63"
2025-01-23T03:27:41Z    DEBUG   [misconfig] Checks successfully loaded from disk
2025-01-23T03:27:41Z    DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-01-23T03:27:41Z    DEBUG   Initializing scan cache...      type="memory"
2025-01-23T03:27:41Z    DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Dockerfile"
2025-01-23T03:27:41Z    DEBUG   [rego] Overriding filesystem for checks
2025-01-23T03:27:41Z    DEBUG   [rego] Embedded libraries are loaded    count=15
2025-01-23T03:27:41Z    DEBUG   [rego] Embedded checks are loaded       count=511
2025-01-23T03:27:41Z    DEBUG   [rego] Checks from disk are loaded      count=532
2025-01-23T03:27:41Z    DEBUG   [rego] Overriding filesystem for data
2025-01-23T03:27:42Z    DEBUG   [dockerfile scanner] Scanning files...  count=1
2025-01-23T03:27:42Z    DEBUG   [rego] Scanning inputs  count=1
2025-01-23T03:27:42Z    DEBUG   OS is not detected.
2025-01-23T03:27:42Z    INFO    Detected config files   num=1
2025-01-23T03:27:42Z    DEBUG   Scanned config file     file_path="Dockerfile"
2025-01-23T03:27:42Z    DEBUG   Found an ignore file    file_path=".trivyignore"
2025-01-23T03:27:42Z    DEBUG   Ignored id="AVD-DS-0002" target="Dockerfile"
2025-01-23T03:27:42Z    DEBUG   Ignored id="AVD-DS-0026" target="Dockerfile"
2025-01-23T03:27:42Z    DEBUG   [vex] VEX filtering is disabled

Operating System

docker container

Version

Version: 0.58.2

Checklist

• Run trivy clean --all
• Read the troubleshooting

[simar7]

thanks again, track #8283