rules:
- id: docker-arbitrary-container-run
  patterns:
  - pattern-either:
    - pattern-inside: |
        $CLIENT = docker.from_env()
        ...
    - pattern-inside: |
        $CLIENT = docker.DockerClient(...)
        ...
  - pattern-either:
    - pattern: |
        $CLIENT.containers.run(...)
    - pattern: |
        $CLIENT.containers.create(...)
  - pattern-not: |
      $CLIENT.containers.run("...",...)
  - pattern-not: |
      $CLIENT.containers.create("...",...)
  message: >-
    If unverified user data can reach the `run` or `create` method it can result in running arbitrary
    container.
  languages:
  - python
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-250: Execution with Unnecessary Privileges'
    category: security
    technology:
    - docker
    references:
    - https://cwe.mitre.org/data/definitions/250.html
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW