diff --git a/rules/S6505/docker/rule.adoc b/rules/S6505/docker/rule.adoc index d9b2ac1eef5..5cf82c8abca 100644 --- a/rules/S6505/docker/rule.adoc +++ b/rules/S6505/docker/rule.adoc @@ -18,10 +18,13 @@ for dependencies to work correctly. Doing this will reduce the attack surface and block a well-known supply chain attack vector. +Commands that are subject to this issue are: `npm install`, `yarn install` and `yarn` +(`yarn` without an explicit command will execute `install`). + == Sensitive Code Example -[source,docker] +[source,docker,diff-id=1,diff-type=noncompliant] ---- FROM node:latest @@ -29,7 +32,7 @@ FROM node:latest RUN npm install ---- -[source,docker] +[source,docker,diff-id=2,diff-type=noncompliant] ---- FROM node:latest @@ -39,14 +42,14 @@ RUN yarn install == Compliant Solution -[source,docker] +[source,docker,diff-id=1,diff-type=compliant] ---- FROM node:latest RUN npm install --ignore-scripts ---- -[source,docker] +[source,docker,diff-id=2,diff-type=compliant] ---- FROM node:latest @@ -72,7 +75,7 @@ ifdef::env-github,rspecator-view[] === Highlighting -Highlight the command and the subcommand, if the latter is present. +Highlight the command and the subcommand if the latter is present. '''