dockerfile: fix CRLF and comment-in-continuation parsing by abezdina · Pull Request #586 · opengrep/opengrep

abezdina · 2026-02-13T11:44:51Z

Summary

Fixes two Dockerfile parsing bugs that caused false positives (e.g., false "last user is root" findings):

CRLF line endings: Added normalize_line_endings to strip \r before parsing, since tree-sitter's line_continuation doesn't match \r\n.
Comments in LABEL continuations: Changed the comment regex from /#./ to /#[^\\\n](?:\.[^\\\n])/ so trailing backslashes aren't swallowed by comments

Test plan

Added parsing test: tests/parsing/dockerfile/label-continuation-comment.dockerfile
Added pattern test: tests/patterns/dockerfile/label-continuation-comment.{dockerfile,sgrep}
Updated tests/patterns/dockerfile/multiline_comment.dockerfile
All existing tests pass, make core builds

maciejpirog · 2026-02-13T12:46:21Z

CI returned this:

  Error: fatal: remote error: upload-pack: not our ref a5babc9ee9653a4bd5236f07c404ced41f1a0860
  Error: fatal: Fetched in submodule path 'languages/dockerfile/tree-sitter/semgrep-dockerfile', but it did not contain a5babc9ee9653a4bd5236f07c404ced41f1a0860. Direct fetching of that commit failed.

Probably this commit was not pushed to the dockerfile submodule.

@abezdina can you first open a relevant PR in https://github.com/opengrep/semgrep-dockerfile (merging to opengrep/main)?

abezdina · 2026-02-13T19:38:47Z

@maciejpirog opened a PR opengrep/semgrep-dockerfile#2
Can you please validate when you have time if it was done correctly

dimitris-m · 2026-02-13T21:36:07Z

opengrep/semgrep-dockerfile#2

you need to update the submodule commit to point to your semgrep-dockerfile branch (for now) and then if the checks turn green here, we can proceed.

the process is this: if this PR is approved, we will merge the semgrep-dockerfile branch into opengrep/main, then update the submodule commit once more here to point to opengrep/main, and merge this one.

once CI is green here we will review your PR, thanks!

dimitris-m · 2026-02-13T21:39:36Z

Also, please rebase your commits to remove this part:

Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com

No problem to use any AI tool of course, but I prefer not to have it as formal "co-author" in our codebase: the PR submitter takes full credit and bears full responsibility for work submitted.

abezdina · 2026-02-14T09:14:31Z

@dimitris-m you are totally right, my bad, fixed prs comments

maciejpirog · 2026-02-17T10:05:12Z

LGTM after the changes.

I merged the PR in the dockerfile repo. @abezdina can you now update this PR so that the dockerfile submodule points to the latest opengrep/main in the dockerfile repo (commit b149e3a17fb827ecef64e1b6c2b64ae2cd2429e4), and I will merge this PR?

(I understand that the process of updating parsers is a bit annoying, we have making it smoother on our TODO list)

maciejpirog · 2026-02-17T11:45:45Z

@abezdina ...and rebase, because there were some pushes to main in between

abezdina · 2026-02-17T12:56:51Z

@maciejpirog done!

Strip \r characters before passing Dockerfile content to tree-sitter, since CRLF line endings break the line_continuation regex pattern.

Change the comment regex from /#.*/ to /#[^\\\n]*(?:\\.[^\\\n]*)*/ so that a trailing backslash on a comment line is NOT consumed as part of the comment token.

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [opengrep/opengrep](https://github.com/opengrep/opengrep) | patch | `v1.16.0` → `v1.16.1` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>opengrep/opengrep (opengrep/opengrep)</summary> ### [`v1.16.1`](https://github.com/opengrep/opengrep/releases/tag/v1.16.1): Opengrep 1.16.1 [Compare Source](opengrep/opengrep@v1.16.0...v1.16.1) #### Improvements - Pin Nuitka to 2.8.9 across all build workflows by [@dimitris-m](https://github.com/dimitris-m) in [#594](opengrep/opengrep#594) - Remove redundant pip and Nuitka dependencies by [@dimitris-m](https://github.com/dimitris-m) in [#573](opengrep/opengrep#573) - Support split rule/target directories in test subcommand by [@qkaiser](https://github.com/qkaiser) in [#576](opengrep/opengrep#576) #### Benchmarking - New benchmarking using hyperfine by [@dimitris-m](https://github.com/dimitris-m) in [#557](opengrep/opengrep#557) and [#579](opengrep/opengrep#579) #### Bug fixes - Allow multiple logical operators in metavariable comparison by [@maciejpirog](https://github.com/maciejpirog) in [#590](opengrep/opengrep#590) - In `--experimental`, don't report git untracked files as skipped with `--use-git-ignore` by [@maciejpirog](https://github.com/maciejpirog) in [#577](opengrep/opengrep#577) - C#: Add primary constructor arguments to base class by [@maciejpirog](https://github.com/maciejpirog) in [#589](opengrep/opengrep#589) - Dockerfile: Add missing buildkit constructs by [@maciejpirog](https://github.com/maciejpirog) in [#581](opengrep/opengrep#581) - Dockerfile: Fix CRLF and comment-in-continuation parsing by [@abezdina](https://github.com/abezdina) in [#586](opengrep/opengrep#586) - Rust: Fix taint propagation through variable shadowing by [@dimitris-m](https://github.com/dimitris-m) in [#572](opengrep/opengrep#572) - TS/TSX: Add support for the `satisfies` construct by [@maciejpirog](https://github.com/maciejpirog) in [#592](opengrep/opengrep#592) #### Installation - Add Windows install script (pwsh) by [@dimitris-m](https://github.com/dimitris-m) in [#569](opengrep/opengrep#569) - Ensure that install.ps1 works on ARM by [@dimitris-m](https://github.com/dimitris-m) in [#571](opengrep/opengrep#571) - Fix: handle unparseable cosign version in install.sh by [@dimitris-m](https://github.com/dimitris-m) in [#580](opengrep/opengrep#580) #### Documentation - Improve the README by [@dimitris-m](https://github.com/dimitris-m) in [#570](opengrep/opengrep#570) #### New Contributors - [@qkaiser](https://github.com/qkaiser) made their first contribution in [#576](opengrep/opengrep#576) - [@abezdina](https://github.com/abezdina) made their first contribution in [#586](opengrep/opengrep#586) **Full Changelog**: <opengrep/opengrep@v1.16.0...v1.16.1> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever MR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

abezdina requested review from corneliuhoffman, dimitris-m, maciejpirog and willem-delbare as code owners February 13, 2026 11:44

abezdina mentioned this pull request Feb 13, 2026

dockerfile: fix comment regex to preserve line continuation backslash opengrep/semgrep-dockerfile#2

Merged

abezdina force-pushed the da/dockerfile-fix-crlf-and-comment-parsing branch from 980396b to cba20d8 Compare February 14, 2026 08:39

abezdina force-pushed the da/dockerfile-fix-crlf-and-comment-parsing branch from cba20d8 to e6f3b88 Compare February 17, 2026 12:55

dinaabezgauz-source added 2 commits February 17, 2026 17:00

dockerfile: normalize CRLF line endings before parsing

36ef907

Strip \r characters before passing Dockerfile content to tree-sitter, since CRLF line endings break the line_continuation regex pattern.

dockerfile: fix comment regex to preserve line continuation backslash

8a390d5

Change the comment regex from /#.*/ to /#[^\\\n]*(?:\\.[^\\\n]*)*/ so that a trailing backslash on a comment line is NOT consumed as part of the comment token.

maciejpirog force-pushed the da/dockerfile-fix-crlf-and-comment-parsing branch from e6f3b88 to 8a390d5 Compare February 17, 2026 16:00

maciejpirog approved these changes Feb 17, 2026

View reviewed changes

maciejpirog merged commit a28cd53 into opengrep:main Feb 17, 2026
6 checks passed

maciejpirog mentioned this pull request Feb 17, 2026

Release v1.16.1 #593

Merged

dimitris-m mentioned this pull request Feb 17, 2026

Release v1.16.1 #595

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

dockerfile: fix CRLF and comment-in-continuation parsing#586

dockerfile: fix CRLF and comment-in-continuation parsing#586
maciejpirog merged 2 commits intoopengrep:mainfrom
abezdina:da/dockerfile-fix-crlf-and-comment-parsing

abezdina commented Feb 13, 2026

Uh oh!

maciejpirog commented Feb 13, 2026

Uh oh!

abezdina commented Feb 13, 2026 •

edited

Loading

Uh oh!

dimitris-m commented Feb 13, 2026

Uh oh!

dimitris-m commented Feb 13, 2026

Uh oh!

abezdina commented Feb 14, 2026

Uh oh!

maciejpirog commented Feb 17, 2026

Uh oh!

maciejpirog commented Feb 17, 2026

Uh oh!

abezdina commented Feb 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

abezdina commented Feb 13, 2026

Uh oh!

maciejpirog commented Feb 13, 2026

Uh oh!

abezdina commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dimitris-m commented Feb 13, 2026

Uh oh!

dimitris-m commented Feb 13, 2026

Uh oh!

abezdina commented Feb 14, 2026

Uh oh!

maciejpirog commented Feb 17, 2026

Uh oh!

maciejpirog commented Feb 17, 2026

Uh oh!

abezdina commented Feb 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

abezdina commented Feb 13, 2026 •

edited

Loading