Repository: Checkmarx/kics (language: python)

Issue:
npm install in a multiline run command is detected as a vulnerability

### Description

The following lines ends up in a _NPM Install Command Without Pinned Version_ vulnerability. All packages are pinned with versions in package.json 

```Dockerfile
#Dockerfile
RUN npm config set registry <internal_npm_registry> && \
    npm install && \
    npx vite build --mode $VITE_MODE

```

If I use three run commands instead, no vulnerability is found.

```Dockerfile
#Dockerfile
  RUN npm config set registry <internal_npm_registry>
  RUN npm install
  RUN npx vite build --mode $VITE_MODE
```


### Expected Behavior

No vulnerability


### Actual Behavior

NPM Install Command Without Pinned Version, Severity: MEDIUM, Results: 1
Description: Check if packages installed by npm are pinning a specific version.
Platform: Dockerfile
Learn more about this vulnerability: https://docs.kics.io/latest/queries/dockerfile-queries/e36d8880-3f78-4546-b9a1-12f0745ca0d5   

        [1]: ../../path/Dockerfile:5

                004: COPY frontend .
                005: RUN npm config set registry <internal_npm_registry> && \
                006:     npm install && \



-   Version: v1.7.4 



Discussion / hints:

Fix patch:
diff --git a/assets/queries/dockerfile/npm_install_without_pinned_version/query.rego b/assets/queries/dockerfile/npm_install_without_pinned_version/query.rego
index cc5535abbed..f5d472adda6 100644
--- a/assets/queries/dockerfile/npm_install_without_pinned_version/query.rego
+++ b/assets/queries/dockerfile/npm_install_without_pinned_version/query.rego
@@ -13,7 +13,9 @@ CxPolicy[result] {
 	indexof(currentCmd, installCmd) > -1
 
 	tokens := split(currentCmd, " ")
-	token := tokens[_]
+    refactor_tokens := [x | x := tokens[_]; x != ""]
+
+	token := refactor_tokens[_]
 
 	token != "npm"
 	token != "install"


Test patch:
diff --git a/assets/queries/dockerfile/npm_install_without_pinned_version/test/negative.dockerfile b/assets/queries/dockerfile/npm_install_without_pinned_version/test/negative1.dockerfile
similarity index 71%
rename from assets/queries/dockerfile/npm_install_without_pinned_version/test/negative.dockerfile
rename to assets/queries/dockerfile/npm_install_without_pinned_version/test/negative1.dockerfile
index 2510224cbf8..e59acc254cd 100644
--- a/assets/queries/dockerfile/npm_install_without_pinned_version/test/negative.dockerfile
+++ b/assets/queries/dockerfile/npm_install_without_pinned_version/test/negative1.dockerfile
@@ -6,3 +6,6 @@ RUN npm install sax@0.1.1 | grep fail && npm install sax@latest
 RUN npm install git://github.com/npm/cli.git
 RUN npm install git+ssh://git@github.com:npm/cli#semver:^5.0
 RUN npm install --production --no-cache
+RUN npm config set registry <internal_npm_registry> && \
+    npm install && \
+    npx vite build --mode $VITE_MODE
\ No newline at end of file
diff --git a/assets/queries/dockerfile/npm_install_without_pinned_version/test/positive.dockerfile b/assets/queries/dockerfile/npm_install_without_pinned_version/test/positive1.dockerfile
similarity index 100%
rename from assets/queries/dockerfile/npm_install_without_pinned_version/test/positive.dockerfile
rename to assets/queries/dockerfile/npm_install_without_pinned_version/test/positive1.dockerfile
diff --git a/assets/queries/dockerfile/npm_install_without_pinned_version/test/positive_expected_result.json b/assets/queries/dockerfile/npm_install_without_pinned_version/test/positive_expected_result.json
index 1f79753c6d5..ec6862cd11b 100644
--- a/assets/queries/dockerfile/npm_install_without_pinned_version/test/positive_expected_result.json
+++ b/assets/queries/dockerfile/npm_install_without_pinned_version/test/positive_expected_result.json
@@ -2,36 +2,43 @@
   {
     "queryName": "NPM Install Command Without Pinned Version",
     "severity": "MEDIUM",
-    "line": 2
+    "line": 2,
+    "filename": "positive1.dockerfile"
   },
   {
     "queryName": "NPM Install Command Without Pinned Version",
     "severity": "MEDIUM",
-    "line": 3
+    "line": 3,
+    "filename": "positive1.dockerfile"
   },
   {
     "queryName": "NPM Install Command Without Pinned Version",
     "severity": "MEDIUM",
-    "line": 4
+    "line": 4,
+    "filename": "positive1.dockerfile"
   },
   {
     "queryName": "NPM Install Command Without Pinned Version",
     "severity": "MEDIUM",
-    "line": 5
+    "line": 5,
+    "filename": "positive1.dockerfile"
   },
   {
     "queryName": "NPM Install Command Without Pinned Version",
     "severity": "MEDIUM",
-    "line": 6
+    "line": 6,
+    "filename": "positive1.dockerfile"
   },
   {
     "queryName": "NPM Install Command Without Pinned Version",
     "severity": "MEDIUM",
-    "line": 7
+    "line": 7,
+    "filename": "positive1.dockerfile"
   },
   {
     "queryName": "NPM Install Command Without Pinned Version",
     "severity": "MEDIUM",
-    "line": 8
+    "line": 8,
+    "filename": "positive1.dockerfile"
   }
-]
+]
\ No newline at end of file