// ===== lnx_imagemagick_reads_rails_secrets.yml (pipeline: none)
(Image endswith "/convert" or Image endswith "/magick" or Image endswith "/identify") and (TargetFilename endswith "/config/master.key" or TargetFilename endswith "/config/credentials.yml.enc" or TargetFilename endswith "/config/secrets.yml" or TargetFilename endswith "/config/database.yml" or TargetFilename endswith "/config/storage.yml" or TargetFilename endswith "/.env" or TargetFilename endswith "/proc/self/environ")

// ===== lnx_imagemagick_writes_sensitive_path.yml (pipeline: none)
(Image endswith "/convert" or Image endswith "/magick" or Image endswith "/identify" or Image endswith "/mogrify") and ((TargetFilename startswith "/etc/cron" or TargetFilename startswith "/var/spool/cron" or TargetFilename startswith "/var/www/" or TargetFilename startswith "/etc/ld.so.preload") or (TargetFilename contains "/.ssh/" or TargetFilename contains "/config/" or TargetFilename contains "/public/" or TargetFilename contains "/app/") or (TargetFilename endswith ".rb" or TargetFilename endswith ".erb" or TargetFilename endswith "/.bashrc"))

// ===== lnx_ruby_or_imagemagick_spawns_shell.yml (pipeline: none)
(ParentImage endswith "/convert" or ParentImage endswith "/magick" or ParentImage endswith "/identify" or ParentImage endswith "/ruby" or ParentImage endswith "/puma" or ParentImage endswith "/unicorn") and (Image endswith "/sh" or Image endswith "/bash" or Image endswith "/dash" or Image endswith "/zsh" or Image endswith "/nc" or Image endswith "/ncat" or Image endswith "/socat" or Image endswith "/curl" or Image endswith "/wget") and (not((CommandLine contains "bundle exec" or CommandLine contains "assets:precompile")))

// ===== lnx_ruby_spawns_imagemagick.yml (pipeline: none)
(ParentImage endswith "/ruby" or ParentImage endswith "/puma" or ParentImage endswith "/unicorn" or ParentImage endswith "/sidekiq") and (Image endswith "/convert" or Image endswith "/magick" or Image endswith "/identify" or Image endswith "/mogrify")

// ===== lnx_svg_msl_mvg_created_in_storage.yml (pipeline: none)
TargetFilename contains "/storage/" and (TargetFilename endswith ".svg" or TargetFilename endswith ".svgz" or TargetFilename endswith ".msl" or TargetFilename endswith ".mvg")

