Fixed the dockerfile.security.missing-user rule

- The previous version of this rule would have false positives on
```
HEALTHCHECK ... \
  CMD ...
ENTRYPOINT ...
```
  There will still be false positives if CMD is not indented on the newline
- There was a separate rule for ENTRYPOINT, which doesn't really make sense,
  since CMD and ENTRYPOINT can be used in the same Dockerfile,
  as per https://docs.docker.com/reference/dockerfile/#exec-form-entrypoint-example
  Therefore, the rule was removed
- There is still a bug that will create two findings for a Dockerfile like this
```
FROM busybox
ENTRYPOINT ["some-command"]
CMD ["--some-arg"]
```
- The autofix arguments have changed because technically it doesn't matter
  where in the Dockerfile the USER directive is specified, insofar as the
  last specified USER is non-root. Previously, the autofix would attempt
  to add the USER directive above the CMD or ENTRYPOINT directives.
  However, since either or both of these can appear, we're not going to
  specify the CMD or ENTRYPOINT directive in the fix.
- Cleaned up some of the test files to remove invalid syntax like calling CMD twice
- Partially fixes semgrep#3436

dockerfile/security/missing-user-entrypoint.dockerfile

@@ -1,14 +1,14 @@
 FROM busybox
 
-# uncomment for ok
+# Leave this hear to test that the missing-user rule doesn't think that commented out lines satisfy the rule
 #USER notroot
 
 RUN git clone https://github.com/returntocorp/semgrep
 RUN pip3 install semgrep
 
-# ruleid: missing-user-entrypoint
-ENTRYPOINT semgrep -f p/xss
+HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 \
+  CMD [ "curl" ]
 
-# TODO: metavar bug
-# ok: missing-user-entrypoint
-ENTRYPOINT ["semgrep", "--config", "localfile", "targets"]
+# ruleid: missing-user
+ENTRYPOINT semgrep -f p/xss
+CMD "--oss-only"

dockerfile/security/missing-user-entrypoint.fixed.dockerfile

@@ -1,15 +1,15 @@
 FROM busybox
 
-# uncomment for ok
+# Leave this hear to test that the missing-user rule doesn't think that commented out lines satisfy the rule
 #USER notroot
 
 RUN git clone https://github.com/returntocorp/semgrep
 RUN pip3 install semgrep
 
-# ruleid: missing-user-entrypoint
+HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 \
+  CMD [ "curl" ]
+
+# ok: missing-user
 USER non-root
 ENTRYPOINT semgrep -f p/xss
-
-# TODO: metavar bug
-# ok: missing-user-entrypoint
-ENTRYPOINT ["semgrep", "--config", "localfile", "targets"]
+CMD "--oss-only"

dockerfile/security/missing-user.dockerfile

@@ -1,17 +1,19 @@
 FROM busybox
 
-# uncomment for ok
+# Leave this hear to test that the missing-user rule doesn't think that commented out lines satisfy the rule
 #USER notroot
 
 RUN git clone https://github.com/returntocorp/semgrep
 RUN pip3 install semgrep
 
-# ruleid: missing-user
-CMD semgrep -f p/xss
+# NOTE: The CMD subdirective should not trigger a false positive
+HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 \
+  CMD [ "curl" ]
 
-# ruleid: missing-user
-CMD semgrep --config localfile targets
+# TODO: Have the rule exclude HEALTHCHECK where CMD on the newline does not follow convention and is not indented
+# NOTE: The CMD subdirective should not trigger a false positive
+# HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 \
+# CMD [ "curl" ]
 
-# TODO: metavar ellipses bug
-# ok: missing-user
-CMD ["semgrep", "--version"]
+# ruleid: missing-user
+CMD semgrep --config localfile targets

dockerfile/security/missing-user.fixed.dockerfile

@@ -6,14 +6,11 @@ FROM busybox
 RUN git clone https://github.com/returntocorp/semgrep
 RUN pip3 install semgrep
 
-# ruleid: missing-user
-USER non-root
-CMD semgrep -f p/xss
+# ok: missing-user
+USER root
 
-# ruleid: missing-user
-USER non-root
-CMD semgrep --config localfile targets
+# NOTE: The CMD subdirective should not trigger a false positive
+HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 \
+  CMD [ "curl" ]
 
-# TODO: metavar ellipses bug
-# ok: missing-user
 CMD ["semgrep", "--version"]

dockerfile/security/missing-user.yaml

@@ -1,19 +1,20 @@
 rules:
 - id: missing-user
   patterns:
-    - pattern: |
-        CMD $...VARS
+    - pattern-either:
+        - pattern-regex: ^CMD
+        - pattern: ENTRYPOINT ...
     - pattern-not-inside: |
+        ...
         USER $USER
         ...
   fix: |
     USER non-root
-    CMD $...VARS
   message: By not specifying a USER, a program in the container may run as 'root'. This is a security
     hazard. If an attacker can control a process running as root, they may have control over the container.
-    Ensure that the last USER in a Dockerfile is a USER other than 'root'. 
+    Ensure that the last USER in a Dockerfile is a USER other than 'root'.
   severity: ERROR
-  languages: 
+  languages:
     - dockerfile
   metadata:
     cwe: