SAST-IaC scanning SQL files as Dockerfile

Summary

One of our customers reported that their SQL files are being scanned as Dockerfiles. This means that vulnerabilities are detected for the SQL files that doesn't really apply to it.

From my testing, it depends on what is the contents of the SQL files. From my testing, something like this will cause SAST-IaC to detect the file as a Dockerfile:

SELECT  
...
FROM  
...
WHERE                                                 
    AND TEST BETWEEN DATE_TRUNC( MONTH, DATEADD(MONTH, -1, TO_DATE( '1999-01-01' ) ) ) AND LAST_DAY( DATEADD(MONTH, 12, TO_DATE( '1999-01-01' ) ) )

Specifically, the line AND TEST BETWEEN DATE_TRUNC( MONTH, DATEADD(MONTH, -1, TO_DATE( '1999-01-01' ) ) ) AND LAST_DAY( DATEADD(MONTH, 12, TO_DATE( '1999-01-01' ) ) ) is the one that is triggering it.

Steps to reproduce

  • Add a file called Testfile in the project with the following contents:
SELECT  

FROM  

WHERE                                                 
    AND TEST BETWEEN DATE_TRUNC( MONTH, DATEADD(MONTH, -1, TO_DATE( '1999-01-01' ) ) ) AND LAST_DAY( DATEADD(MONTH, 12, TO_DATE( '1999-01-01' ) ) )
  • Add the following .gitlab-ci.yml file.
include:
  - template: Security/SAST-IaC.gitlab-ci.yml

Example Project

https://gitlab.com/jdasmarinas/sast-iac-bug

What is the current bug behavior?

Files that aren't Dockerfiles are being treated like a Dockerfile.

What is the expected correct behavior?

SAST-IaC should ignore these files.

Relevant logs and/or screenshots

Output of checks

This bug happens on GitLab.com

Results of GitLab environment info

Expand for output related to GitLab environment info 
(For installations with omnibus-gitlab package run and paste the output of:
`sudo gitlab-rake gitlab:env:info`)

(For installations from source run and paste the output of:
`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)

Results of GitLab application Check

Expand for output related to the GitLab application check 
(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true)


(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true)


(we will only investigate if the tests are passing)

Possible fixes