Skip to content

Commit 057b598

Browse files
committed
Perform more strict validation of *all* media types
Docker media types inside OCI media types is semantically fine (and Docker sure doesn't care), but technically invalid, so this increases our validation from just the manifest media type all the way down to the config and layer media types also.
1 parent 82fa443 commit 057b598

File tree

1 file changed

+9
-1
lines changed

1 file changed

+9
-1
lines changed

cmd/bashbrew/oci-builder.go

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,15 @@ func ociImportBuild(tags []string, commit, dir, file string) error {
163163
}
164164

165165
otherBlobs := append([]imagespec.Descriptor{manifest.Config}, manifest.Layers...)
166-
for _, blob := range otherBlobs {
166+
for i, blob := range otherBlobs {
167+
if i == 0 && blob.MediaType != imagespec.MediaTypeImageConfig {
168+
return fmt.Errorf("unsupported mediaType %q for config descriptor %s", blob.MediaType, errFileStr(string(blob.Digest)))
169+
} else if i != 0 && blob.MediaType != imagespec.MediaTypeImageLayer && blob.MediaType != imagespec.MediaTypeImageLayerGzip && blob.MediaType != imagespec.MediaTypeImageLayerZstd {
170+
return fmt.Errorf("unsupported mediaType %q for layer descriptor %s", blob.MediaType, errFileStr(string(blob.Digest)))
171+
}
172+
if blob.Size < 0 {
173+
return fmt.Errorf("invalid size %d in blob descriptor %s", blob.Size, errFileStr(string(blob.Digest)))
174+
}
167175
if err := importOCIBlob(ctx, cs, fs, blob); err != nil {
168176
return fmt.Errorf("failed to import blob %s: %w", errFileStr(string(blob.Digest)), err)
169177
}

0 commit comments

Comments
 (0)