2.0.19 fixed false positive for apk no cache arg detection

Author: NordCoderd

CHANGELOG.md

@@ -2,7 +2,13 @@
 
 # Cloud (IaC) Security Changelog
 
-## [2.0.18] 10-05-2026
+## [2.0.19] 01-05-2026
+
+### Fixed
+
+- Fixed false positive for apk no cache arg detection, thanks to [m0nclous](https://github.com/m0nclous)
+
+## [2.0.18] 10-04-2026 
 
 ### Changed
 - Updated plugin to support new version of the IntelliJ Platform, thanks to [kylichist](https://github.com/kylichist)

gradle.properties

@@ -1,7 +1,7 @@
 pluginGroup = dev.protsenko.securityLinter
 pluginName = Cloud (IaC) Security
 pluginRepositoryUrl = https://github.com/NordCoderd/cloud-security-plugin
-pluginVersion = 2.0.18
+pluginVersion = 2.0.19
 
 # Supported build number ranges and IntelliJ Platform versions -> https://plugins.jetbrains.com/docs/intellij/build-number-ranges.html
 pluginSinceBuild = 231

src/main/kotlin/dev/protsenko/securityLinter/docker/checker/ApkNoCacheValidator.kt

@@ -3,9 +3,28 @@ package dev.protsenko.securityLinter.docker.checker
 import dev.protsenko.securityLinter.docker.checker.core.RunCommandValidator
 
 object ApkNoCacheValidator : RunCommandValidator {
+    /**
+     * Matches valid Dockerfile RUN commands for Alpine package installation.
+     *
+     * Two alternative valid forms are accepted:
+     *
+     * 1. BuildKit cache-mount path: the command has a --mount=type=cache flag whose target
+     *    key equals /var/cache/apk (optional trailing slash or surrounding quotes). BuildKit
+     *    keeps /var/cache/apk off the final image layer, so --no-cache is not needed.
+     *    The exemption is revoked when the command also contains rm -rf /var/cache/apk/star,
+     *    which would defeat the cache-mount benefit.
+     *
+     * 2. Standard path: the command either omits apk add entirely or includes --no-cache;
+     *    and it never calls apk update (which bloats image layers); and it never manually
+     *    removes /var/cache/apk/star (redundant when --no-cache is already present).
+     */
     private val VALID_COMMAND_PATTERN =
         Regex(
-            "^\\s*RUN(?:(?!.*apk add)|(?=.*--no-cache))(?!.*apk update)(?!.*rm\\s+.*?/var/cache/apk/\\*).*$",
+            "^\\s*RUN(?:" +
+                "(?=.*--mount=type=cache(?=\\S*,target=\"?/var/cache/apk/?\"?)\\S*)(?!.*rm\\s+\\S*r\\S*\\s+.*?/var/cache/apk/\\*)" +
+                "|" +
+                "(?:(?!.*apk add)|(?=.*--no-cache))(?!.*apk update)(?!.*rm\\s+.*?/var/cache/apk/\\*)" +
+                ").*\$",
             RegexOption.DOT_MATCHES_ALL,
         )
 

src/test/kotlin/dev/protsenko/securityLinter/utils/ApkNoCacheValidatorTest.kt

@@ -17,6 +17,23 @@ class ApkNoCacheApkNoCacheValidatorTest : TestCase() {
         assertTrue(ApkNoCacheValidator.isValid(multiLineValid))
         assertTrue(ApkNoCacheValidator.isValid("RUN ./autoupdate-script.sh"))
         assertTrue(ApkNoCacheValidator.isValid(" RUN apk add --no-cache git"))
+        // BuildKit cache mount cases — no --no-cache required (fixing DFS030 false positive)
+        assertTrue(ApkNoCacheValidator.isValid("RUN --mount=type=cache,target=/var/cache/apk apk add curl git"))
+        assertTrue(ApkNoCacheValidator.isValid("RUN --mount=type=cache,target=/var/cache/apk/ apk add curl"))
+        assertTrue(ApkNoCacheValidator.isValid("RUN --mount=type=cache,target=\"/var/cache/apk\" apk add curl"))
+        assertTrue(ApkNoCacheValidator.isValid("RUN --mount=type=cache,target=/var/cache/apk,sharing=locked,id=apk apk add curl"))
+        assertTrue(ApkNoCacheValidator.isValid("RUN --mount=type=cache,id=apk,target=/var/cache/apk apk add curl"))
+        assertTrue(ApkNoCacheValidator.isValid("RUN --mount=type=secret,id=x --mount=type=cache,target=/var/cache/apk apk add curl"))
+        val multiLineMount =
+            """
+            RUN --mount=type=cache,target=/var/cache/apk \
+                apk add curl git
+            """.trimIndent()
+        assertTrue(ApkNoCacheValidator.isValid(multiLineMount))
+        // Both mount and --no-cache present — must remain valid without double-detection
+        assertTrue(ApkNoCacheValidator.isValid("RUN --mount=type=cache,target=/var/cache/apk apk add --no-cache curl"))
+        // Mount covers apk update too
+        assertTrue(ApkNoCacheValidator.isValid("RUN --mount=type=cache,target=/var/cache/apk apk update && apk add curl"))
     }
 
     fun testInvalidCommands() {
@@ -33,5 +50,12 @@ class ApkNoCacheApkNoCacheValidatorTest : TestCase() {
         assertFalse(ApkNoCacheValidator.isValid(multiLineInvalid))
         assertFalse(ApkNoCacheValidator.isValid("apk add --no-cache git"))
         assertFalse(ApkNoCacheValidator.isValid(""))
+        // Mount present but wrong target — still invalid
+        assertFalse(ApkNoCacheValidator.isValid("RUN --mount=type=cache,target=/root/.cache apk add curl"))
+        // Wrong mount type — only type=cache exempts
+        assertFalse(ApkNoCacheValidator.isValid("RUN --mount=type=bind,target=/var/cache/apk apk add curl"))
+        assertFalse(ApkNoCacheValidator.isValid("RUN --mount=type=tmpfs,target=/var/cache/apk apk add curl"))
+        // Cache mount + explicit rm defeats caching — still invalid
+        assertFalse(ApkNoCacheValidator.isValid("RUN --mount=type=cache,target=/var/cache/apk apk add curl && rm -rf /var/cache/apk/*"))
     }
 }

src/test/testData/docker/DFS030/Dockerfile.allowed

@@ -1,2 +1,6 @@
 FROM alpine:3.13
-RUN apk add --no-cache git
+<warning descr="Multiple consecutive 'RUN' instructions. Consider consolidation.">RUN apk add --no-cache git</warning>
+<warning descr="Multiple consecutive 'RUN' instructions. Consider consolidation.">RUN --mount=type=cache,target=/var/cache/apk apk add curl git</warning>
+<warning descr="Multiple consecutive 'RUN' instructions. Consider consolidation.">RUN --mount=type=cache,target=/var/cache/apk,sharing=locked apk add curl</warning>
+<warning descr="Multiple consecutive 'RUN' instructions. Consider consolidation.">RUN --mount=type=secret,id=s --mount=type=cache,target=/var/cache/apk \
+    apk add curl</warning>

src/test/testData/docker/DFS030/Dockerfile.denied

@@ -1,3 +1,4 @@
 FROM alpine:3.13
 <warning descr="Alpine package installation without --no-cache, consider using it to reduce image size."><warning descr="Multiple consecutive 'RUN' instructions. Consider consolidation.">RUN apk add git</warning></warning>
-<warning descr="Alpine package installation without --no-cache, consider using it to reduce image size."><warning descr="Multiple consecutive 'RUN' instructions. Consider consolidation.">RUN apk add git && rm -rf /var/cache/apk/*</warning></warning>
+<warning descr="Alpine package installation without --no-cache, consider using it to reduce image size."><warning descr="Multiple consecutive 'RUN' instructions. Consider consolidation.">RUN apk add git && rm -rf /var/cache/apk/*</warning></warning>
+<warning descr="Alpine package installation without --no-cache, consider using it to reduce image size."><warning descr="Multiple consecutive 'RUN' instructions. Consider consolidation.">RUN --mount=type=cache,target=/root/.cache apk add curl</warning></warning>