add check if there is actually a package manager in the run command

[Morl99]

Simplify rule to use regex instead of splitting

closes https://github.com/aquasecurity/defsec/issues/1256

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Morl99]

The CLA checker does not seem to be aware, that I am a member of the https://github.com/dbsystel organization, and that our organization has signed a CLA.

[simar7]

Thanks could you format the rego check with opa fmt -w?

[Morl99]

Thanks could you format the rego check with opa fmt -w?

Done

I have added a line about that to the CONTRIBUTING.md.

[nikpivkin]

When using regex, we will not be able to establish that the update command refers to the package manager. Example of a command that causes a false positive:apt-get build-dep && /bin/sh /scripts/someScript.sh update. Maybe we should split the command by && and check each part?

[nikpivkin]

@simar7 I think we should also check the package manager along with the install command.
apt-get update && /bin/sh /scripts/someScript.sh install doesn't trigger a warning, but this apt-get update && /bin/sh /scripts/someScript.sh other-cmd does. Does it relate to this PR?

[Morl99]

@simar7 I think we should also check the package manager along with the install command.

apt-get update && /bin/sh /scripts/someScript.sh install doesn't trigger a warning, but this apt-get update && /bin/sh /scripts/someScript.sh other-cmd does. Does it relate to this PR?

True, that is the other side of the original issue, that we could fix here as well. I will rework the code to also cover this false negative.

[simar7]

@simar7 I think we should also check the package manager along with the install command.
apt-get update && /bin/sh /scripts/someScript.sh install doesn't trigger a warning, but this apt-get update && /bin/sh /scripts/someScript.sh other-cmd does. Does it relate to this PR?

True, that is the other side of the original issue, that we could fix here as well. I will rework the code to also cover this false negative.

Sounds good to me.