From 43954568fdb932b33c608757f05275aab221297c Mon Sep 17 00:00:00 2001
From: Dan Cristoloveanu <dcristo@microsoft.com>
Date: Wed, 30 Sep 2026 19:37:39 -0700
Subject: [PATCH 1/2] Update Valleysoft.DockerfileModel to 2.0.0 for heredoc
 support

Valleysoft.DockerfileModel 1.2.0 predates BuildKit heredoc support, so any Dockerfile using RUN/COPY <<EOF fails to parse and the detector skips it. 2.0.0 adds heredoc parsing; the detector code compiles and behaves unchanged against it.

Adds regression tests for RUN heredocs, a syntax directive with an interpreter heredoc, a multi-stage file with COPY heredoc and COPY --from, and a heredoc body containing a FROM line that must not be reported.

Fixes #1878

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Directory.Packages.props                      |   2 +-
 docs/detectors/dockerfile.md                  |   2 +
 .../DockerfileComponentDetectorTests.cs       | 124 ++++++++++++++++++
 3 files changed, 127 insertions(+), 1 deletion(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index d1cf38c0c..21e67f6a1 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -48,7 +48,7 @@
     <PackageVersion Include="Tomlyn.Signed" Version="0.20.0" />
     <PackageVersion Include="yamldotnet" Version="16.3.0" />
     <PackageVersion Include="Faker.net" Version="2.0.163" />
-    <PackageVersion Include="Valleysoft.DockerfileModel" Version="1.2.0" />
+    <PackageVersion Include="Valleysoft.DockerfileModel" Version="2.0.0" />
     <!-- Fix security alerts -->
     <PackageVersion Include="System.Formats.Asn1" Version="9.0.13" />
   </ItemGroup>
diff --git a/docs/detectors/dockerfile.md b/docs/detectors/dockerfile.md
index 2da4fa3a4..febfad138 100644
--- a/docs/detectors/dockerfile.md
+++ b/docs/detectors/dockerfile.md
@@ -12,6 +12,8 @@ The `DockerfileComponentDetector` is an **Experimental** detector. It runs autom
 
 The Dockerfile detector parses Dockerfile syntax to extract Docker image references from `FROM` and `COPY --from` instructions. It uses the [Valleysoft.DockerfileModel](https://github.com/mthalman/DockerfileModel) library to parse Dockerfile syntax.
 
+BuildKit [here-documents](https://docs.docker.com/reference/dockerfile/#here-documents) (for example `RUN <<EOF` or `COPY <<EOF /path`) are supported. A heredoc body is treated as opaque content, so a `FROM` line inside it is not reported as an image reference.
+
 ### FROM Instruction Detection
 The detector extracts base image references from `FROM` instructions and resolves multi-stage build references:
 - Direct image references (e.g., `FROM ubuntu:22.04`)
diff --git a/test/Microsoft.ComponentDetection.Detectors.Tests/DockerfileComponentDetectorTests.cs b/test/Microsoft.ComponentDetection.Detectors.Tests/DockerfileComponentDetectorTests.cs
index 90d685172..0baa8430f 100644
--- a/test/Microsoft.ComponentDetection.Detectors.Tests/DockerfileComponentDetectorTests.cs
+++ b/test/Microsoft.ComponentDetection.Detectors.Tests/DockerfileComponentDetectorTests.cs
@@ -305,4 +305,128 @@ public async Task TestDockerfile_FromWithUnresolvedArgVariableIsSkippedAsync()
         scanResult.ResultCode.Should().Be(ProcessingResultCode.Success);
         componentRecorder.GetDetectedComponents().Should().BeEmpty();
     }
+
+    [TestMethod]
+    public async Task TestDockerfile_RunHeredocAsync()
+    {
+        // BuildKit heredoc syntax: https://docs.docker.com/reference/dockerfile/#here-documents
+        var dockerfile = @"
+FROM ubuntu:noble
+
+RUN <<EOF
+set -eux
+apt-get update
+EOF
+";
+
+        var loggerMock = new Mock<ILogger<DockerfileComponentDetector>>();
+
+        var (scanResult, componentRecorder) = await this.DetectorTestUtility
+            .WithFile("Dockerfile", dockerfile)
+            .AddServiceMock(loggerMock)
+            .ExecuteDetectorAsync();
+
+        scanResult.ResultCode.Should().Be(ProcessingResultCode.Success);
+        var components = componentRecorder.GetDetectedComponents();
+        components.Should().ContainSingle();
+
+        var dockerRef = components.First().Component as DockerReferenceComponent;
+        dockerRef.Should().NotBeNull();
+        dockerRef!.Repository.Should().Be("library/ubuntu");
+        dockerRef.Tag.Should().Be("noble");
+
+        loggerMock.Verify(
+            logger => logger.Log(
+                It.Is<LogLevel>(level => level >= LogLevel.Warning),
+                It.IsAny<EventId>(),
+                It.IsAny<It.IsAnyType>(),
+                It.IsAny<Exception>(),
+                It.IsAny<Func<It.IsAnyType, Exception?, string>>()),
+            Times.Never);
+    }
+
+    [TestMethod]
+    public async Task TestDockerfile_RunHeredocWithInterpreterAndSyntaxDirectiveAsync()
+    {
+        var dockerfile = @"# syntax=docker/dockerfile:1.4
+FROM ubuntu:noble-20260113
+
+RUN <<END_OF_SCRIPT bash
+set -e
+apt-get update
+END_OF_SCRIPT
+";
+
+        var (scanResult, componentRecorder) = await this.DetectorTestUtility
+            .WithFile("Dockerfile", dockerfile)
+            .ExecuteDetectorAsync();
+
+        scanResult.ResultCode.Should().Be(ProcessingResultCode.Success);
+        var components = componentRecorder.GetDetectedComponents();
+        components.Should().ContainSingle();
+
+        var dockerRef = components.First().Component as DockerReferenceComponent;
+        dockerRef.Should().NotBeNull();
+        dockerRef!.Repository.Should().Be("library/ubuntu");
+        dockerRef.Tag.Should().Be("noble-20260113");
+    }
+
+    [TestMethod]
+    public async Task TestDockerfile_HeredocMultiStageWithCopyFromStageAsync()
+    {
+        var dockerfile = @"
+FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
+RUN <<EOF
+set -eux
+dotnet publish -c Release -o /out
+EOF
+
+FROM mcr.microsoft.com/dotnet/runtime-deps:8.0
+COPY <<EOF /etc/app.conf
+setting=value
+EOF
+COPY --from=build /out /app
+";
+
+        var (scanResult, componentRecorder) = await this.DetectorTestUtility
+            .WithFile("Dockerfile", dockerfile)
+            .ExecuteDetectorAsync();
+
+        scanResult.ResultCode.Should().Be(ProcessingResultCode.Success);
+        var components = componentRecorder.GetDetectedComponents();
+        components.Should().HaveCount(2);
+
+        var repos = components
+            .Select(c => c.Component as DockerReferenceComponent)
+            .Where(c => c != null)
+            .Select(c => c!.Repository)
+            .ToList();
+        repos.Should().Contain("dotnet/sdk");
+        repos.Should().Contain("dotnet/runtime-deps");
+    }
+
+    [TestMethod]
+    public async Task TestDockerfile_HeredocBodyIsNotParsedAsInstructionsAsync()
+    {
+        // A heredoc body is opaque content, so a FROM line inside it is not a base image.
+        var dockerfile = @"
+FROM alpine:3.20
+RUN <<EOF cat > /tmp/Dockerfile.inner
+FROM inner/image:1.0
+EOF
+";
+
+        var (scanResult, componentRecorder) = await this.DetectorTestUtility
+            .WithFile("Dockerfile", dockerfile)
+            .ExecuteDetectorAsync();
+
+        scanResult.ResultCode.Should().Be(ProcessingResultCode.Success);
+        var components = componentRecorder.GetDetectedComponents();
+        components.Should().ContainSingle();
+
+        var dockerRef = components.First().Component as DockerReferenceComponent;
+        dockerRef.Should().NotBeNull();
+        dockerRef!.Repository.Should().Be("library/alpine");
+        dockerRef.Tag.Should().Be("3.20");
+    }
 }

From bf5d57747b4824b7510c867b87def7469e770926 Mon Sep 17 00:00:00 2001
From: Dan Cristoloveanu <dcristo@microsoft.com>
Date: Thu, 1 Oct 2026 19:01:43 -0700
Subject: [PATCH 2/2] Bump DockerfileComponentDetector version to 2

Heredoc Dockerfiles that were previously skipped now produce components, which the detector version policy treats as an output change.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../dockerfile/DockerfileComponentDetector.cs                   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Microsoft.ComponentDetection.Detectors/dockerfile/DockerfileComponentDetector.cs b/src/Microsoft.ComponentDetection.Detectors/dockerfile/DockerfileComponentDetector.cs
index 00760e336..72f9dbcf9 100644
--- a/src/Microsoft.ComponentDetection.Detectors/dockerfile/DockerfileComponentDetector.cs
+++ b/src/Microsoft.ComponentDetection.Detectors/dockerfile/DockerfileComponentDetector.cs
@@ -42,7 +42,7 @@ public DockerfileComponentDetector(
 
     public override IEnumerable<ComponentType> SupportedComponentTypes { get; } = [ComponentType.DockerReference];
 
-    public override int Version => 1;
+    public override int Version => 2;
 
     protected override IList<string> SkippedFolders => ["node_modules"];