update format string for SecretsUsedInArgOrEnv rule check

Signed-off-by: Talon Bowler <[email protected]>

Author: daghack

frontend/dockerfile/dockerfile2llb/convert.go

@@ -1128,7 +1128,7 @@ func dispatchEnv(d *dispatchState, c *instructions.EnvCommand, lint *linter.Lint
 			msg := linter.RuleLegacyKeyValueFormat.Format(c.Name())
 			lint.Run(&linter.RuleLegacyKeyValueFormat, c.Location(), msg)
 		}
-		validateNoSecretKey(e.Key, c.Location(), lint)
+		validateNoSecretKey("ENV", e.Key, c.Location(), lint)
 		commitMessage.WriteString(" " + e.String())
 		d.state = d.state.AddEnv(e.Key, e.Value)
 		d.image.Config.Env = addEnv(d.image.Config.Env, e.Key, e.Value)
@@ -1707,7 +1707,7 @@ func dispatchShell(d *dispatchState, c *instructions.ShellCommand) error {
 func dispatchArg(d *dispatchState, c *instructions.ArgCommand, opt *dispatchOpt) error {
 	commitStrs := make([]string, 0, len(c.Args))
 	for _, arg := range c.Args {
-		validateNoSecretKey(arg.Key, c.Location(), opt.lint)
+		validateNoSecretKey("ARG", arg.Key, c.Location(), opt.lint)
 		_, hasValue := opt.buildArgValues[arg.Key]
 		hasDefault := arg.Value != nil
 
@@ -2375,10 +2375,10 @@ func getSecretsRegex() *regexp.Regexp {
 	return secretsRegexp
 }
 
-func validateNoSecretKey(key string, location []parser.Range, lint *linter.Linter) {
+func validateNoSecretKey(instruction, key string, location []parser.Range, lint *linter.Linter) {
 	pattern := getSecretsRegex()
 	if pattern.MatchString(key) {
-		msg := linter.RuleSecretsUsedInArgOrEnv.Format(key)
+		msg := linter.RuleSecretsUsedInArgOrEnv.Format(instruction, key)
 		lint.Run(&linter.RuleSecretsUsedInArgOrEnv, location, msg)
 	}
 }

frontend/dockerfile/dockerfile_lint_test.go

@@ -59,64 +59,64 @@ ENV git_key=
 		Warnings: []expectedLintWarning{
 			{
 				RuleName:    "SecretsUsedInArgOrEnv",
-				Description: "Potentially sensitive data should not be used in the ARG or ENV commands",
-				Detail:      `Secrets should not be used in the ARG or ENV commands (key named "SECRET_PASSPHRASE")`,
+				Description: "Sensitive data should not be used in the ARG or ENV commands",
+				Detail:      `Do not use ARG or ENV instructions for sensitive data (ARG "SECRET_PASSPHRASE")`,
 				URL:         "https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/",
 				Level:       1,
 				Line:        3,
 			},
 			{
 				RuleName:    "SecretsUsedInArgOrEnv",
-				Description: "Potentially sensitive data should not be used in the ARG or ENV commands",
-				Detail:      `Secrets should not be used in the ARG or ENV commands (key named "SUPER_Secret")`,
+				Description: "Sensitive data should not be used in the ARG or ENV commands",
+				Detail:      `Do not use ARG or ENV instructions for sensitive data (ENV "SUPER_Secret")`,
 				URL:         "https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/",
 				Level:       1,
 				Line:        4,
 			},
 			{
 				RuleName:    "SecretsUsedInArgOrEnv",
-				Description: "Potentially sensitive data should not be used in the ARG or ENV commands",
-				Detail:      `Secrets should not be used in the ARG or ENV commands (key named "password")`,
+				Description: "Sensitive data should not be used in the ARG or ENV commands",
+				Detail:      `Do not use ARG or ENV instructions for sensitive data (ENV "password")`,
 				URL:         "https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/",
 				Level:       1,
 				Line:        5,
 			},
 			{
 				RuleName:    "SecretsUsedInArgOrEnv",
-				Description: "Potentially sensitive data should not be used in the ARG or ENV commands",
-				Detail:      `Secrets should not be used in the ARG or ENV commands (key named "secret")`,
+				Description: "Sensitive data should not be used in the ARG or ENV commands",
+				Detail:      `Do not use ARG or ENV instructions for sensitive data (ENV "secret")`,
 				URL:         "https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/",
 				Level:       1,
 				Line:        5,
 			},
 			{
 				RuleName:    "SecretsUsedInArgOrEnv",
-				Description: "Potentially sensitive data should not be used in the ARG or ENV commands",
-				Detail:      `Secrets should not be used in the ARG or ENV commands (key named "super_duper_secret_token")`,
+				Description: "Sensitive data should not be used in the ARG or ENV commands",
+				Detail:      `Do not use ARG or ENV instructions for sensitive data (ARG "super_duper_secret_token")`,
 				URL:         "https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/",
 				Level:       1,
 				Line:        6,
 			},
 			{
 				RuleName:    "SecretsUsedInArgOrEnv",
-				Description: "Potentially sensitive data should not be used in the ARG or ENV commands",
-				Detail:      `Secrets should not be used in the ARG or ENV commands (key named "auth")`,
+				Description: "Sensitive data should not be used in the ARG or ENV commands",
+				Detail:      `Do not use ARG or ENV instructions for sensitive data (ARG "auth")`,
 				URL:         "https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/",
 				Level:       1,
 				Line:        6,
 			},
 			{
 				RuleName:    "SecretsUsedInArgOrEnv",
-				Description: "Potentially sensitive data should not be used in the ARG or ENV commands",
-				Detail:      `Secrets should not be used in the ARG or ENV commands (key named "apikey")`,
+				Description: "Sensitive data should not be used in the ARG or ENV commands",
+				Detail:      `Do not use ARG or ENV instructions for sensitive data (ENV "apikey")`,
 				URL:         "https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/",
 				Level:       1,
 				Line:        7,
 			},
 			{
 				RuleName:    "SecretsUsedInArgOrEnv",
-				Description: "Potentially sensitive data should not be used in the ARG or ENV commands",
-				Detail:      `Secrets should not be used in the ARG or ENV commands (key named "git_key")`,
+				Description: "Sensitive data should not be used in the ARG or ENV commands",
+				Detail:      `Do not use ARG or ENV instructions for sensitive data (ENV "git_key")`,
 				URL:         "https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/",
 				Level:       1,
 				Line:        8,

frontend/dockerfile/linter/ruleset.go

@@ -132,12 +132,12 @@ var (
 			return fmt.Sprintf("Setting platform to predefined %s in FROM is redundant as this is the default behavior", platformVar)
 		},
 	}
-	RuleSecretsUsedInArgOrEnv = LinterRule[func(string) string]{
+	RuleSecretsUsedInArgOrEnv = LinterRule[func(string, string) string]{
 		Name:        "SecretsUsedInArgOrEnv",
 		Description: "Sensitive data should not be used in the ARG or ENV commands",
 		URL:         "https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/",
-		Format: func(secretKey string) string {
-			return fmt.Sprintf("Secrets should not be used in the ARG or ENV commands (key named %q)", secretKey)
+		Format: func(instruction, secretKey string) string {
+			return fmt.Sprintf("Do not use ARG or ENV instructions for sensitive data (%s %q)", instruction, secretKey)
 		},
 	}
 )