Repository: Checkmarx/kics (language: python)

Issue:
File requirements used in pip install not checked ?
Found a bug? You're welcome to [![GitHub Discussions](https://img.shields.io/badge/chat-discussions-blue.svg?style=flat-square)](https://github.com/Checkmarx/kics/discussions)


- **Please make sure to:**
  - Describe in details what the problem is
  - Attach a log file with relevant data preferably in DEBUG level (`--log-level=DEBUG`)
  - Attach the scanned sample files, anonymize the data if the original file cannot be provided
  - When attaching files to the issue make sure they are properly formatted

### Expected Behavior

(Which results are expected from KICS?)

* File pip_requirements.txt checked
* No trigger for rule `02d9c71f-3ee8-4986-9c27-1a20d0d19bfc`


### Actual Behavior

(Formatted logs and samples helps us to better understand the issue)

I'm trying to fix some KICS rules at this moment and i have some troubles with this one : `02d9c71f-3ee8-4986-9c27-1a20d0d19bfc` that is present in my results but i pinned all the packages in my file `pip_requirements.txt` used in my dockerfile. KICS is executed in a Github action here.

* KICS command launch by my Github action :
```
15:38 - INF : kics command kics -p .cloud,inventories,playbooks -o ./ --report-formats json,json   --config /github/home/merged_assets/kics-config.yaml       -q /github/home/merged_assets/queries/  --ignore-on-exit results --fail-on high
```
* Command used in the dockerfile to install python packages : 
```
RUN pip3 install --no-cache-dir -r pip_requirements.txt
```
* File `pip_requirements.txt` : 
```
ansible-lint==6.0.2
ansible==7.5.0
jinjalint==0.5
jmespath==1.0.1
molecule==3.6.1
molecule-docker==1.1.0
netaddr==0.8.0
yamllint==1.30.0
```

* Debug output in my CI (i censored the parts where i'm unsure if it's sensitive or not) :
```
		{
			"query_name": "Unpinned Package Version in Pip Install",
			"query_id": "02d9c71f-3ee8-4986-9c27-1a20d0d19bfc",
			"query_url": "https://docs.docker.com/develop/develop-images/dockerfile_best-practices/",
			"severity": "MEDIUM",
			"platform": "Dockerfile",
			"category": "Supply-Chain",
			"description": "Package version pinning reduces the range of versions that can be installed, reducing the chances of failure due to unanticipated changes",
			"description_id": "37db3a53",
			"files": [
				{
					"file_name": ".cloud/docker/Dockerfile",
					"similarity_id": "<censored>",
					"line": 17,
					"issue_type": "IncorrectValue",
					"search_key": "FROM={{<censored>/ubuntu:22.04}}.{{RUN pip3 install --no-cache-dir -r pip_requirements.txt}}",
					"search_line": 0,
					"search_value": "",
					"expected_value": "RUN instruction with 'pip/pip3 install \u003cpackage\u003e' should use package pinning form 'pip/pip3 install \u003cpackage\u003e=\u003cversion\u003e'",
					"actual_value": "RUN instruction pip3 install --no-cache-dir -r pip_requirements.txt does not use package pinning form"
				}
			]
		},
```

### Steps to Reproduce the Problem

(Command line arguments and flags used)

1.  Create a dockerfile Ubuntu22.04
2.  Add the command pip to install the packages from pip_requirements.txt file
3.  Launch KICS scan

### Specifications
(N/A if not applicable)

-   Version:  v1.6.13
-   Platform: Github Action
-   Subsystem: Docker



Discussion / hints:
I am running KICS 1.7.3 and still have this bug

Fix patch:
diff --git a/assets/queries/dockerfile/unpinned_package_version_in_pip_install/query.rego b/assets/queries/dockerfile/unpinned_package_version_in_pip_install/query.rego
index f2cb65d48a5..268199179fb 100644
--- a/assets/queries/dockerfile/unpinned_package_version_in_pip_install/query.rego
+++ b/assets/queries/dockerfile/unpinned_package_version_in_pip_install/query.rego
@@ -2,6 +2,8 @@ package Cx
 
 import data.generic.dockerfile as dockerLib
 
+flags = ["-r", "-c"]
+
 CxPolicy[result] {
 	resource := input.document[i].command[name][_]
 	resource.Cmd == "run"
@@ -13,10 +15,13 @@ CxPolicy[result] {
 	yum != null
 
 	packages = dockerLib.getPackages(commands, yum)
-	length := count(packages)
+    refactorPackages = [ x | x := packages[_]; x != ""]
+    length := count(refactorPackages)
+
+	count({x | x := refactorPackages[_]; x == flags[_]}) == 0
 
 	some j
-	analyzePackages(j, packages[j], packages, length)
+	analyzePackages(j, refactorPackages[j], packages, length)
 
 	result := {
 		"documentId": input.document[i].id,
@@ -57,7 +62,7 @@ isPip(command) {
 	contains(command[j], "install")
 }
 
-analyzePackages(j, currentPackage, packages, length) {
+analyzePackages(j, currentPackage, _, length) {
 	j == length - 1
 	regex.match("^[a-zA-Z]", currentPackage) == true
 	not dockerLib.withVersion(currentPackage)


Test patch:
diff --git a/assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/negative.dockerfile b/assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/negative1.dockerfile
similarity index 100%
rename from assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/negative.dockerfile
rename to assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/negative1.dockerfile
diff --git a/assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/negative2.dockerfile b/assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/negative2.dockerfile
new file mode 100644
index 00000000000..9cccff38e1a
--- /dev/null
+++ b/assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/negative2.dockerfile
@@ -0,0 +1,9 @@
+FROM alpine:3.4
+RUN apk add --update py-pip=7.1.2-r0
+RUN pip3 install -r pip_requirements.txt
+COPY requirements.txt /usr/src/app/
+RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt
+COPY app.py /usr/src/app/
+COPY templates/index.html /usr/src/app/templates/
+EXPOSE 5000
+CMD ["python", "/usr/src/app/app.py"]
diff --git a/assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/negative3.dockerfile b/assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/negative3.dockerfile
new file mode 100644
index 00000000000..45b7b963e50
--- /dev/null
+++ b/assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/negative3.dockerfile
@@ -0,0 +1,9 @@
+FROM alpine:3.4
+RUN apk add --update py-pip=7.1.2-r0
+RUN pip3 install -c constraints.txt
+COPY requirements.txt /usr/src/app/
+RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt
+COPY app.py /usr/src/app/
+COPY templates/index.html /usr/src/app/templates/
+EXPOSE 5000
+CMD ["python", "/usr/src/app/app.py"]
\ No newline at end of file
diff --git a/assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/positive.dockerfile b/assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/positive1.dockerfile
similarity index 100%
rename from assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/positive.dockerfile
rename to assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/positive1.dockerfile
diff --git a/assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/positive_expected_result.json b/assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/positive_expected_result.json
index ab2bb5198d3..4ffe50570bf 100644
--- a/assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/positive_expected_result.json
+++ b/assets/queries/dockerfile/unpinned_package_version_in_pip_install/test/positive_expected_result.json
@@ -2,21 +2,25 @@
   {
     "queryName": "Unpinned Package Version in Pip Install",
     "severity": "MEDIUM",
-    "line": 3
+    "line": 3,
+    "filename": "positive1.dockerfile"
   },
   {
     "queryName": "Unpinned Package Version in Pip Install",
     "severity": "MEDIUM",
-    "line": 4
+    "line": 4,
+    "filename": "positive1.dockerfile"
   },
   {
     "queryName": "Unpinned Package Version in Pip Install",
     "severity": "MEDIUM",
-    "line": 15
+    "line": 15,
+    "filename": "positive1.dockerfile"
   },
   {
     "queryName": "Unpinned Package Version in Pip Install",
     "severity": "MEDIUM",
-    "line": 18
+    "line": 18,
+    "filename": "positive1.dockerfile"
   }
 ]