Repository: Checkmarx/kics (language: python)

Issue:
[Docker] Version not explicit fails in multi-stage dockerfile
When using a dockerfile that has multi-stage but uses `as` instead of `AS` in the `FROM` instruction, KICS detects that as a "version not explicit" issue.

### Expected Behavior

No issue should be flagged. Docker works with either `as` or `AS` in multi-stage references, so KICS should support both.

### Actual Behavior

Medium severity issue is flagged with the "Version not explicit" query (Query ID: 9efb0b2d-89c9-41a3-91ca-dcc0aec911fd).

### Steps to Reproduce the Problem

1.  Create a dockerfile like so:
```Dockerfile
FROM ubuntu:22.04 as test
RUN echo "hello"

FROM test as build
RUN echo "build"

FROM build as final
RUN echo "final"
```
3.  Run the following command:
```sh
docker run -it -v $(pwd):/path checkmarx/kics:latest scan --log-level DEBUG -v -p /path/Dockerfile -o "/path/"
```
5.  See the output which will contain the following issue:
```
Image Version Not Explicit, Severity: MEDIUM, Results: 2
Description: Always tag the version of an image explicitly
Platform: Dockerfile
Learn more about this vulnerability: https://docs.kics.io/latest/queries/dockerfile-queries/9efb0b2d-89c9-41a3-91ca-dcc0aec911fd

        [1]: ../../path/Dockerfile:7

                006:
                007: FROM build as final
                008: RUN echo "final"


        [2]: ../../path/Dockerfile:4

                003:
                004: FROM test as build
                005: RUN echo "build"
```
6. Replace all `as` with `AS` and rerun the scan, you will no longer find the issue.

### Specifications

N/A


Discussion / hints:

Fix patch:
diff --git a/assets/queries/dockerfile/image_version_not_explicit/query.rego b/assets/queries/dockerfile/image_version_not_explicit/query.rego
index 4d5f3bf7f27..670e124ee41 100644
--- a/assets/queries/dockerfile/image_version_not_explicit/query.rego
+++ b/assets/queries/dockerfile/image_version_not_explicit/query.rego
@@ -43,16 +43,16 @@ versionNotExplicit(cmd) {
 	count(cmd) > 1
 
 	not contains(cmd[0], ":")
+    count([x | x := input.document[i].command[name][_]; build_name_exists(x, cmd[0])]) == 0
+}
 
-	resource := input.document[i].command[name][_]
+build_name_exists(resource, build_name){
 	not resource.Value[0] == "scratch"
 	resource.Cmd == "from"
 
 	count(resource.Value) > 1
 
-	resource.Value[1] == "as"
-
-	resource.Value[2] == cmd[0]
+	lower(resource.Value[1]) == "as"
 
-	not contains(resource.Value[0], ":")
-}
+	resource.Value[2] == build_name
+}
\ No newline at end of file


Test patch:
diff --git a/assets/queries/dockerfile/image_version_not_explicit/test/negative.dockerfile b/assets/queries/dockerfile/image_version_not_explicit/test/negative1.dockerfile
similarity index 100%
rename from assets/queries/dockerfile/image_version_not_explicit/test/negative.dockerfile
rename to assets/queries/dockerfile/image_version_not_explicit/test/negative1.dockerfile
diff --git a/assets/queries/dockerfile/image_version_not_explicit/test/negative2.dockerfile b/assets/queries/dockerfile/image_version_not_explicit/test/negative2.dockerfile
new file mode 100644
index 00000000000..1da90378154
--- /dev/null
+++ b/assets/queries/dockerfile/image_version_not_explicit/test/negative2.dockerfile
@@ -0,0 +1,8 @@
+FROM ubuntu:22.04 AS test
+RUN echo "hello"
+
+FROM test AS build
+RUN echo "build"
+
+FROM build AS final
+RUN echo "final"
\ No newline at end of file
diff --git a/assets/queries/dockerfile/image_version_not_explicit/test/positive.dockerfile b/assets/queries/dockerfile/image_version_not_explicit/test/positive1.dockerfile
similarity index 100%
rename from assets/queries/dockerfile/image_version_not_explicit/test/positive.dockerfile
rename to assets/queries/dockerfile/image_version_not_explicit/test/positive1.dockerfile
diff --git a/assets/queries/dockerfile/image_version_not_explicit/test/positive2.dockerfile b/assets/queries/dockerfile/image_version_not_explicit/test/positive2.dockerfile
new file mode 100644
index 00000000000..6fc18a10a04
--- /dev/null
+++ b/assets/queries/dockerfile/image_version_not_explicit/test/positive2.dockerfile
@@ -0,0 +1,8 @@
+FROM ubuntu:22.04 AS test
+RUN echo "hello"
+
+FROM test AS build
+RUN echo "build"
+
+FROM construction AS final
+RUN echo "final"
\ No newline at end of file
diff --git a/assets/queries/dockerfile/image_version_not_explicit/test/positive_expected_result.json b/assets/queries/dockerfile/image_version_not_explicit/test/positive_expected_result.json
index e4e93fee282..cd389735b38 100644
--- a/assets/queries/dockerfile/image_version_not_explicit/test/positive_expected_result.json
+++ b/assets/queries/dockerfile/image_version_not_explicit/test/positive_expected_result.json
@@ -2,6 +2,13 @@
 	{
 		"queryName": "Image Version Not Explicit",
 		"severity": "MEDIUM",
+		"fileName": "positive1.dockerfile",
 		"line": 1
+	},
+	{
+		"queryName": "Image Version Not Explicit",
+		"severity": "MEDIUM",
+		"fileName": "positive2.dockerfile",
+		"line": 7
 	}
 ]