Description

Detects usage of Docker ADD command which can enable Zip Slip attacks when handling archive files. The ADD instruction can extract archives during image builds without properly validating file paths, potentially allowing malicious archives to write files outside the target directory.

Detection Strategy

• Search Dockerfile for lines beginning with 'ADD' command

• Report vulnerability when ADD instruction is found followed by whitespace and additional content

• Each ADD command instance is flagged since it represents potential archive extraction without path validation

Vulnerable code example

FROM ubuntu:latest

WORKDIR /app

# Vulnerable: copies files without explicit user permissions
COPY package*.json ./
RUN npm install
...

✅ Secure code example

FROM ubuntu:20.04@sha256:450e066588f42ebe1551f3b1a535034b6aa46cd936fe7f2c6b0d72997ec61dbd

# Create non-root user and group
RUN groupadd -r appuser && useradd -r -g appuser appuser

WORKDIR /app

# Set proper ownership for work directory...