rules:
- id: secret-in-build-arg
  patterns:
  - pattern-either:
    - pattern: ARG $ARG
    - pattern: ARG $ARG=...
  - metavariable-regex:
      metavariable: $ARG
      regex: (?i).*(password|secret|token|key|cert|api|auth)
  message: >-
    Docker build time arguments are not suited for secrets, because the
    argument values are saved with the image. Running `docker image history` on the
    image will show information on how the image was built, including arguments. If
    these contain plain text secrets, anyone with access to the docker image can access
    those secrets and exploit them.
  metadata:
    category: security
    technology:
    - dockerfile
    cwe:
    - 'CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory'
    owasp:
    - A01:2021 - Broken Access Control
    references:
    - https://cwe.mitre.org/data/definitions/538.html
    - https://docs.docker.com/engine/reference/builder/#arg
    subcategory:
      - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
  languages:
    - dockerfile
  severity: WARNING