Merge Develop into Release

dockerfile/best-practice/missing-apk-no-cache.dockerfile

@@ -29,3 +29,7 @@ RUN apk add --no-cache --virtual .build-deps \
 gcc \
 freetype-dev \
 musl-dev
+
+
+# ok: missing-apk-no-cache
+RUN apk --no-cache add

dockerfile/best-practice/missing-apk-no-cache.yaml

@@ -3,8 +3,8 @@ rules:
     patterns:
       - pattern: |
           RUN apk $COMMAND ...
-      - pattern-not: |
-          RUN apk $CMD ... --no-cache ...
+      - pattern-not-inside: |
+          RUN apk ... --no-cache ...
     languages:
       - dockerfile
     message: >-

dockerfile/security/last-user-is-root.dockerfile

@@ -5,5 +5,8 @@ RUN git clone https://github.com/returntocorp/semgrep
 RUN pip3 install semgrep
 RUN semgrep -f p/xss
 USER swuser
+USER root
+
+USER user1
 # ruleid: last-user-is-root
 USER root

dockerfile/security/last-user-is-root.yaml

@@ -1,23 +1,17 @@
 rules:
 - id: last-user-is-root
   patterns:
-    - pattern-inside: |
-        USER $F
-        ...
-        USER $X
-    # nosemgrep: yaml.semgrep.slow-pattern-top-ellipsis
-    - pattern-not-inside: |
-        ...
-        USER $X
-        ...
-        USER $F
-    - focus-metavariable: $X
-    - metavariable-regex:
-        metavariable: $X
-        regex: ^(root)$
-    - metavariable-regex:
-        metavariable: $F
-        regex: (.*(?!root))
+    - pattern: USER root
+    - pattern-not-inside:
+        patterns:
+          - pattern: |
+              USER root
+              ...
+              USER $X
+          - metavariable-pattern:
+              metavariable: $X
+              patterns:
+                - pattern-not: root
   message: >-
     The last user in the container is 'root'. This is a security
     hazard because if an attacker gains control of the container