Description

Detects Docker ADD instructions that automatically extract tar archives during image builds. The builder unpacks the archive without validating its entry paths, so a malicious archive can write files outside the target directory (Zip Slip) or exhaust disk space (Zip Bomb).

Detection Strategy

• Join Dockerfile instructions across backslash continuations, skipping comment and blank lines

• Parse ADD instructions in shell and JSON form, separating leading flags from the source and destination operands

• Report local sources with a tar archive extension, optionally compressed with gzip, bzip2, xz or zstd

• Report remote sources only when the --unpack flag requests their extraction

• Skip instructions with --unpack disabled, Git sources, and non-tar files such as zip archives

Vulnerable code example

FROM node:16-alpine

WORKDIR /usr/src/app

# Vulnerable: the local tarball is unpacked with no control over its entry paths
ADD vendor/third-party-libs.tar.gz /opt/libs/

✅ Secure code example

FROM ubuntu:20.04@sha256:450e066588f42ebe1551f3b1a535034b6aa46cd936fe7f2c6b0d72997ec61dbd

# Create non-root user and group
RUN groupadd -r appuser && useradd -r -g appuser appuser

WORKDIR /app

# Set proper ownership for work directory...