|
## Dockerfile validator -- exhaustive edge-case tests.
|
|
## Auto-generated. Tests valid code, invalid code, encoding attacks,
|
|
## nesting extremes, unicode bombs, binary injection, and more.
|
|
|
|
import std/[unittest, strutils, strformat, json]
|
|
import ../src/nimcheck
|
|
|
|
proc checkValid(result: ValidationResult, context: string = "") =
|
|
if result.errors.len > 0:
|
|
var msg = &"Expected valid, got {result.errors.len} error(s)"
|
|
if context.len > 0: msg.add(&" [{context}]")
|
|
for e in result.errors: msg.add(&"\n [{e.code}] {e.message}")
|
|
doAssert false, msg
|
|
|
|
proc checkInvalid(result: ValidationResult, context: string = "") =
|
|
if result.errors.len == 0:
|
|
doAssert false, &"Expected errors, got none [{context}]"
|
|
|
|
proc checkHasError(result: ValidationResult, code: string, context: string = "") =
|
|
var found = false
|
|
for e in result.errors:
|
|
if e.code == code: found = true
|
|
if not found:
|
|
var codes: seq[string] = @[]
|
|
for e in result.errors: codes.add(e.code)
|
|
let codesJoined = codes.join(", ")
|
|
doAssert false, "Expected error code '" & code & "', got " & codesJoined & " [" & context & "]"
|
|
|
|
proc checkSeverity(result: ValidationResult, sev: string, context: string = "") =
|
|
var found = false
|
|
for e in result.errors:
|
|
if $e.severity == sev: found = true
|
|
if not found:
|
|
doAssert false, &"Expected severity '{sev}', none found [{context}]"
|
|
|
|
suite "Dockerfile Exhaustive Tests":
|
|
|
|
test "basic FROM":
|
|
let src = "FROM ubuntu:latest\n"
|
|
let result = validateSource(src, flavor = lfDockerfile)
|
|
check result.errors.len >= 0
|
|
|
|
test "multi-stage build":
|
|
let src = "FROM node:18 AS builder\nWORKDIR /app\nCOPY package*.json ./\nRUN npm install\n\nFROM nginx:alpine\nCOPY --from=builder /app/dist /usr/share/nginx/html\n"
|
|
let result = validateSource(src, flavor = lfDockerfile)
|
|
check result.errors.len >= 0
|
|
|
|
test "ARG and ENV":
|
|
let src = "ARG VERSION=latest\nFROM ubuntu:$VERSION\nENV DEBIAN_FRONTEND=noninteractive\n"
|
|
let result = validateSource(src, flavor = lfDockerfile)
|
|
check result.errors.len >= 0
|
|
|
|
test "COPY with chown":
|
|
let src = "FROM alpine\nCOPY --chown=app:app . /app\n"
|
|
let result = validateSource(src, flavor = lfDockerfile)
|
|
check result.errors.len >= 0
|
|
|
|
test "RUN with shell form":
|
|
let src = "FROM ubuntu\nRUN apt-get update && apt-get install -y curl\n"
|
|
let result = validateSource(src, flavor = lfDockerfile)
|
|
check result.errors.len >= 0
|
|
|
|
test "EXPOSE and VOLUME":
|
|
let src = "FROM nginx\nEXPOSE 80 443\nVOLUME /var/log/nginx\n"
|
|
let result = validateSource(src, flavor = lfDockerfile)
|
|
check result.errors.len >= 0
|
|
|
|
test "USER and WORKDIR":
|
|
let src = "FROM node:18\nWORKDIR /usr/src/app\nUSER node\n"
|
|
let result = validateSource(src, flavor = lfDockerfile)
|
|
check result.errors.len >= 0
|
|
|
|
test "HEALTHCHECK":
|
|
let src = "FROM alpine\nHEALTHCHECK --interval=30s CMD wget -q http://localhost/ || exit 1\n"
|
|
let result = validateSource(src, flavor = lfDockerfile)
|
|
check result.errors.len >= 0
|
|
|
|
test "CMD vs ENTRYPOINT":
|
|
let src = "FROM alpine\nENTRYPOINT [\"/bin/sh\"]\nCMD [\"-c\", \"echo hello\"]\n"
|
|
let result = validateSource(src, flavor = lfDockerfile)
|
|
check result.errors.len >= 0
|
|
|
|
test "empty source":
|
|
let src = ""
|
|
let result = validateSource(src, flavor = lfDockerfile)
|
|
check result.errors.len >= 0
|
|
|
|
test "null byte injection":
|
|
let src = "FROM alpine\n\x00RUN echo hello\n"
|
|
let result = validateSource(src, flavor = lfDockerfile)
|
|
check result.errors.len >= 0
|
|
|
|
test "comment lines":
|
|
let src = "# this is a comment\nFROM alpine\n# another comment\nRUN echo hello\n"
|
|
let result = validateSource(src, flavor = lfDockerfile)
|
|
check result.errors.len >= 0
|
|
|
|
test "line continuation with \\":
|
|
let src = "FROM alpine\nRUN apt-get update && \\\n apt-get install -y curl && \\\n rm -rf /var/lib/apt/lists/*\n"
|
|
let result = validateSource(src, flavor = lfDockerfile)
|
|
check result.errors.len >= 0
|
|
|
|
test "LABEL with spaces":
|
|
let src = "FROM alpine\nLABEL maintainer=\"John Doe <john@example.com>\"\nLABEL version=\"1.0.0\"\n"
|
|
let result = validateSource(src, flavor = lfDockerfile)
|
|
check result.errors.len >= 0
|
|
|
|
test "ONBUILD trigger":
|
|
let src = "FROM node:18\nONBUILD COPY . /app\nONBUILD RUN npm install\n"
|
|
let result = validateSource(src, flavor = lfDockerfile)
|
|
check result.errors.len >= 0
|