Downloaded script piped into a shell (ARCH10005)

Ce contenu n’est pas encore disponible dans votre langue.

Key config.docker.pipe-to-shell · Severity warning · Category security · CWE CWE-494

curl ... | sh runs whatever the server answers, during the build, with the build’s rights, and leaves no record of what ran. The next build may run something else.

Incorrect

FROM debian:12.7-slim
RUN curl -fsSL https://get.example.com/install.sh | sh
USER 65534

Correct

FROM debian:12.7-slim
RUN curl -fsSLo /tmp/install.sh https://get.example.com/install.sh \
 && echo "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08  /tmp/install.sh" | sha256sum -c - \
 && sh /tmp/install.sh
USER 65534

Fix

Download the script to a file, verify its checksum or signature, then run it.

Not flagged

A download saved to a file and run separately.