fix(query): checkFollowedBy query refactor

assets/queries/dockerfile/update_instruction_alone/query.rego

@@ -1,70 +1,116 @@
 package Cx
 
 CxPolicy[result] {
+	# Check if there is a command that runs install before update
 	resource := input.document[i].command[name][_]
 	resource.Cmd == "run"
 	count(resource.Value) == 1
 	command := resource.Value[0]
+    commandList := split(command, " ")
+    commandRefactor := [x | x := commandList[_]; x != ""]
+    packages := [l | commandRefactor[0] == pkg[l]]
+    count(packages) > 0
+    packageManager := pkg[packages[0]]
 
-	isValidUpdate(command)
-	not phpComposerPhar(command)
-	not updateFollowedByInstall(command)
+	update := [x | x := getDetail(commandRefactor, pkg_updater[packageManager][_]); count(x) > 0]
+    count(update) > 0
 
+	install := [x | x := getDetail(commandRefactor, pkg_installer[packageManager][_]); count(x) > 0]
+    count(install) > 0
+
+	not checkFollowedBy(update, install)
+
 	result := {
 		"documentId": input.document[i].id,
 		"searchKey": sprintf("FROM={{%s}}.RUN={{%s}}", [name, resource.Value[0]]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": "Instruction 'RUN <package-manager> update' should be followed by 'RUN <package-manager> install' ",
-		"keyActualValue": "Instruction 'RUN <package-manager> update' isn't followed by 'RUN <package-manager> install in the same 'RUN' statement",
+		"keyExpectedValue": sprintf("Instruction 'RUN %s %s' should be followed by 'RUN %s %s' in the same 'RUN' statement", [packageManager, pkg_installer[packageManager], packageManager, pkg_updater[packageManager]]),
+		"keyActualValue": sprintf("Instruction 'RUN %s %s' isn't followed by 'RUN %s %s in the same 'RUN' statement", [packageManager, pkg_installer[packageManager], packageManager, pkg_updater[packageManager]]),
 	}
 }
 
-isValidUpdate(command) {
-	contains(command, " update ")
-}
+CxPolicy[result] {
+	#Check if there is Update Command without Install Command
+	resource := input.document[i].command[name][n]
+	commandRefactor := getRunCommand(resource)
+    packages := [l | commandRefactor[0] == pkg[l]]
+    count(packages) > 0
+    packageManager := pkg[packages[0]]
 
-isValidUpdate(command) {
-	contains(command, " --update ")
-}
+	update := [x | x := getDetail(commandRefactor, pkg_updater[packageManager][_]); count(x) > 0]
+    count(update) > 0
 
-isValidUpdate(command) {
-	array_split := split(command, " ")
+	install := [x | x := getDetail(commandRefactor, pkg_installer[packageManager][_]); count(x) > 0]
+    count(install) == 0
+
+    #Check if any of the next commands is RUN install Command and there is not Update Command
+    nextResources := array.slice(input.document[i].command[name], n+1, count(input.document[i].command[name]))
+    nextResource := nextResources[_]
+	nextCommandRefactor := getRunCommand(nextResource)
+    nextPackages := [l | nextCommandRefactor[0] == pkg[l]]
+    count(nextPackages) > 0
+    nextPackageManager := pkg[nextPackages[0]]
+	nextPackageManager == packageManager
+
+	nextInstall := [x | x := getDetail(nextCommandRefactor, pkg_installer[nextPackageManager][_]); count(x) > 0]
+    count(nextInstall) > 0
 
-	len = count(array_split)
+	nextUpdate := [x | x := getDetail(nextCommandRefactor, pkg_updater[nextPackageManager][_]); count(x) > 0]
+    count(nextUpdate) == 0
+
+    result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("FROM={{%s}}.RUN={{%s}}", [name, nextResource.Value[0]]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": sprintf("Instruction 'RUN %s %s' should be combined with 'RUN %s %s' in the same 'RUN' statement", [nextPackageManager, pkg_installer[nextPackageManager], nextPackageManager, pkg_updater[nextPackageManager]]),
+		"keyActualValue": sprintf("Instruction 'RUN %s %s' isn't combined with 'RUN %s %s in the same 'RUN' statement", [nextPackageManager, pkg_installer[nextPackageManager], nextPackageManager, pkg_updater[nextPackageManager]]),
+	}
+}
 
-	update := {"update", "--update"}
+pkg := [
+    "apt-get",
+    "apk",
+    "yum",
+    "dnf",
+    "zypper",
+    "pacman",
+    "apt",
+    "pkg_add"
+]
 
-	array_split[len - 1] == update[j]
+pkg_updater := {
+    "apt-get": ["update"],
+    "apk": ["update"],
+    "yum": ["update"],
+    "dnf": ["update"],
+    "zypper": ["refresh"],
+    "pacman": ["-Syu"],
+    "apt": ["update"],
 }
 
-phpComposerPhar(command) {
-	php := {x | x := indexof_n(command, "php"); count(x) != 0}
-	count(php) > 0
-	composer := {x | x := indexof_n(command, "composer"); count(x) != 0}
-	count(composer) > 0
-	checkFollowedBy(php[_],composer)
-	update := {x | x := indexof_n(command, "update"); count(x) != 0}
-	count(update) > 0
-	checkFollowedBy(composer[_],update)
+pkg_installer := {
+    "apt-get": ["install", "source-install", "reinstall"],
+    "apk": ["add"],
+    "yum": ["install"],
+    "dnf": ["install"],
+    "zypper": ["install"],
+    "pacman": ["-S"],
+    "apt": ["install"],
 }
 
-commandList := [
-	"install",
-	"source-install",
-	"reinstall",
-	"groupinstall",
-	"localinstall",
-	"add",
-]
 
-updateFollowedByInstall(command) {
-	update := {x | x := indexof_n(command, "update"); count(x) != 0}
-	count(update) > 0
-	install := {x | x := indexof_n(command, commandList[_]); count(x) != 0}
-	count(install) > 0
-	checkFollowedBy(update[_], install)
+getRunCommand(resource) = commandRefactor {
+	resource.Cmd == "run"
+	count(resource.Value) == 1
+	command := resource.Value[0]
+    commandList := split(command, " ")
+    commandRefactor := [x | x := commandList[_]; x != ""]
+}
+
+getDetail(commandRefactor, value) = list{
+	list := [u | commandRefactor[u] == value]
 }
 
 checkFollowedBy(first, after) {
-	first[_] < after[_][_]
+	first[_] < after[_]
 }

assets/queries/dockerfile/update_instruction_alone/test/negative10.dockerfile

@@ -0,0 +1,6 @@
+FROM alpine:latest
+RUN apk update && apk add nginx
+RUN apk --update-cache add vim
+RUN apk -U add nano
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/update_instruction_alone/test/negative11.dockerfile

@@ -0,0 +1,5 @@
+FROM alpine:latest
+RUN apk --update add nginx
+RUN apk add --update nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/update_instruction_alone/test/negative4.dockerfile

@@ -0,0 +1,4 @@
+FROM archlinux:latest
+RUN pacman -Syu && pacman -S nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/update_instruction_alone/test/negative5.dockerfile

@@ -0,0 +1,5 @@
+FROM ubuntu:18.04
+RUN apt-get update && apt-get install -y --no-install-recommends mysql-client \
+    && rm -rf /var/lib/apt/lists/*
+RUN apk update
+ENTRYPOINT ["mysql"]

assets/queries/dockerfile/update_instruction_alone/test/negative6.dockerfile

@@ -0,0 +1,4 @@
+FROM opensuse:latest
+RUN zypper refresh && zypper install nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/update_instruction_alone/test/negative7.dockerfile

@@ -0,0 +1,4 @@
+FROM debian:latest
+RUN apt update && install nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/update_instruction_alone/test/negative8.dockerfile

@@ -0,0 +1,4 @@
+FROM centos:latest
+RUN yum update && yum install nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/update_instruction_alone/test/negative9.dockerfile

@@ -0,0 +1,4 @@
+FROM fedora:latest
+RUN dnf update && dnf install nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/update_instruction_alone/test/positive1.dockerfile

@@ -0,0 +1,5 @@
+FROM alpine:latest
+RUN apk update
+RUN apk add nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/update_instruction_alone/test/positive2.dockerfile

@@ -0,0 +1,5 @@
+FROM opensuse:latest
+RUN zypper refresh
+RUN zypper install nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/update_instruction_alone/test/positive3.dockerfile

@@ -0,0 +1,5 @@
+FROM debian:latest
+RUN apt update
+RUN apt install nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/update_instruction_alone/test/positive4.dockerfile

@@ -0,0 +1,5 @@
+FROM centos:latest
+RUN yum update
+RUN yum install nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/update_instruction_alone/test/positive5.dockerfile

@@ -0,0 +1,5 @@
+FROM fedora:latest
+RUN dnf update
+RUN dnf install nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/update_instruction_alone/test/positive6.dockerfile

@@ -0,0 +1,5 @@
+FROM archlinux:latest
+RUN pacman -Syu
+RUN pacman -S nginx
+
+CMD ["nginx", "-g", "daemon off;"]

assets/queries/dockerfile/update_instruction_alone/test/positive.dockerfile → assets/queries/dockerfile/update_instruction_alone/test/positive7.dockerfile

@@ -3,4 +3,4 @@ RUN apt-get update
 RUN apt-get install -y --no-install-recommends mysql-client \
     && rm -rf /var/lib/apt/lists/*
 RUN apk update
-ENTRYPOINT ["mysql"]
+ENTRYPOINT ["mysql"]

assets/queries/dockerfile/update_instruction_alone/test/positive_expected_result.json

@@ -2,11 +2,43 @@
   {
     "queryName": "Update Instruction Alone",
     "severity": "MEDIUM",
-    "line": 2
+    "line": 3,
+    "fileName": "positive1.dockerfile"
   },
   {
     "queryName": "Update Instruction Alone",
     "severity": "MEDIUM",
-    "line": 5
+    "line": 3,
+    "fileName": "positive2.dockerfile"
+  },
+  {
+    "queryName": "Update Instruction Alone",
+    "severity": "MEDIUM",
+    "line": 3,
+    "fileName": "positive3.dockerfile"
+  },
+  {
+    "queryName": "Update Instruction Alone",
+    "severity": "MEDIUM",
+    "line": 3,
+    "fileName": "positive4.dockerfile"
+  },
+  {
+    "queryName": "Update Instruction Alone",
+    "severity": "MEDIUM",
+    "line": 3,
+    "fileName": "positive5.dockerfile"
+  },
+  {
+    "queryName": "Update Instruction Alone",
+    "severity": "MEDIUM",
+    "line": 3,
+    "fileName": "positive6.dockerfile"
+  },
+  {
+    "queryName": "Update Instruction Alone",
+    "severity": "MEDIUM",
+    "line": 3,
+    "fileName": "positive7.dockerfile"
   }
 ]