feat(java): detect non-literal container bind-mount source paths built by concatenation (CWE-22)

java/jenkins/docker/bind-mount-nonliteral-path.yaml

@@ -0,0 +1,37 @@
+rules:
+  - id: codevigilant.java.jenkins.docker.bind-mount-nonliteral-path
+    message: >-
+      Detected a docker/podman container bind-mount (-v / --volume) whose
+      source path is built from a string concatenation of non-literal values
+      (variables, env expansion or metavariable-derived values). In a Jenkins
+      plugin such values can originate from build parameters or SCM-controlled
+      environment variables; the mounted host path is then exposed read-write
+      inside the scan/builder container (which usually runs as root). An
+      attacker who controls the parameter can mount arbitrary host paths
+      (e.g. /var/run/docker.sock for daemon control, or /etc/shadow for secret
+      disclosure) into the container (CWE-22). Bind-mount sources must be
+      validated against an allowlist of safe paths and never be built from
+      attacker-influenced values.
+    languages: [java]
+    severity: HIGH
+    metadata:
+      category: security
+      cwe: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+      owasp: "A01:2021 - Broken Access Control"
+      technology: jenkins
+      confidence: MEDIUM
+      references:
+        - https://www.jenkins.io/doc/developer/security/
+        - https://docs.docker.com/engine/storage/bind-mounts/
+      source: independent security review
+      license: MIT
+    patterns:
+      - pattern-either:
+          - pattern: $BUILDER.add(..., "-v", $SRC + ":" + $DST, ...);
+          - pattern: $BUILDER.add(..., "--volume", $SRC + ":" + $DST, ...);
+      - metavariable-pattern:
+          metavariable: $SRC
+          patterns:
+            - pattern-not: '"..."'
+      - pattern-not: $BUILDER.add(..., "-v", $SRC + ":" + $SRC + ":ro", ...);
+      - pattern-not: $BUILDER.add(..., "-v", $SRC + ":" + $SRC + ":Z", ...);