From 412fea0f4fa961a21be9132e47b8d303cba5feba Mon Sep 17 00:00:00 2001
From: ai-anant <ant2010in@gmail.com>
Date: Fri, 4 Sep 2026 09:44:38 +0530
Subject: [PATCH] feat(java): detect non-literal docker/podman bind-mount paths
 (CWE-22)

---
 .../docker/bind-mount-nonliteral-path.yaml    | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 java/jenkins/docker/bind-mount-nonliteral-path.yaml

diff --git a/java/jenkins/docker/bind-mount-nonliteral-path.yaml b/java/jenkins/docker/bind-mount-nonliteral-path.yaml
new file mode 100644
index 0000000..a964553
--- /dev/null
+++ b/java/jenkins/docker/bind-mount-nonliteral-path.yaml
@@ -0,0 +1,37 @@
+rules:
+  - id: codevigilant.java.jenkins.docker.bind-mount-nonliteral-path
+    message: >-
+      Detected a docker/podman container bind-mount (-v / --volume) whose
+      source path is built from a string concatenation of non-literal values
+      (variables, env expansion or metavariable-derived values). In a Jenkins
+      plugin such values can originate from build parameters or SCM-controlled
+      environment variables; the mounted host path is then exposed read-write
+      inside the scan/builder container (which usually runs as root). An
+      attacker who controls the parameter can mount arbitrary host paths
+      (e.g. /var/run/docker.sock for daemon control, or /etc/shadow for secret
+      disclosure) into the container (CWE-22). Bind-mount sources must be
+      validated against an allowlist of safe paths and never be built from
+      attacker-influenced values.
+    languages: [java]
+    severity: HIGH
+    metadata:
+      category: security
+      cwe: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+      owasp: "A01:2021 - Broken Access Control"
+      technology: jenkins
+      confidence: MEDIUM
+      references:
+        - https://www.jenkins.io/doc/developer/security/
+        - https://docs.docker.com/engine/storage/bind-mounts/
+      source: independent security review
+      license: MIT
+    patterns:
+      - pattern-either:
+          - pattern: $BUILDER.add(..., "-v", $SRC + ":" + $DST, ...);
+          - pattern: $BUILDER.add(..., "--volume", $SRC + ":" + $DST, ...);
+      - metavariable-pattern:
+          metavariable: $SRC
+          patterns:
+            - pattern-not: '"..."'
+      - pattern-not: $BUILDER.add(..., "-v", $SRC + ":" + $SRC + ":ro", ...);
+      - pattern-not: $BUILDER.add(..., "-v", $SRC + ":" + $SRC + ":Z", ...);
\ No newline at end of file