mcp-server-semgrep/semgrep-rules/dockerfile/security/missing-user.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: missing-user
  patterns:
    - pattern: |
        CMD $...VARS
    - pattern-not-inside: |
        USER $USER
        ...
  fix: |
    USER non-root
    CMD $...VARS
  message: By not specifying a USER, a program in the container may run as 'root'. This is a security
    hazard. If an attacker can control a process running as root, they may have control over the container.
    Ensure that the last USER in a Dockerfile is a USER other than 'root'. 
  severity: ERROR
  languages: 
    - dockerfile
  metadata:
    cwe:
    - 'CWE-269: Improper Privilege Management'
    category: security
    technology:
    - dockerfile
    confidence: MEDIUM
    owasp:
    - A04:2021 - Insecure Design
    references:
    - https://owasp.org/Top10/A04_2021-Insecure_Design
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM