Merge pull request #1379 from fluxcd/backport-1377-to-release/v1.2.x

[release/v1.2.x] Improve chart name validation

Author: darkowlzz

internal/helm/chart/builder.go

@@ -81,9 +81,9 @@ func (r RemoteReference) Validate() error {
 	if r.Name == "" {
 		return fmt.Errorf("no name set for remote chart reference")
 	}
-	name := regexp.MustCompile("^([-a-z0-9]+/?)+$")
+	name := regexp.MustCompile(`^([-a-z0-9]+/?\.?)+$`)
 	if !name.MatchString(r.Name) {
-		return fmt.Errorf("invalid chart name '%s': a valid name must be lower case letters and numbers and MAY be separated with dashes (-) or slashes (/)", r.Name)
+		return fmt.Errorf("invalid chart name '%s': a valid name must be lower case letters and numbers and MAY be separated with dashes (-), slashes (/) or periods (.)", r.Name)
 	}
 	return nil
 }
@@ -199,6 +199,11 @@ func (b *Build) String() string {
 
 // packageToPath attempts to package the given chart to the out filepath.
 func packageToPath(chart *helmchart.Chart, out string) error {
+	// Names cannot have directory name characters.
+	if chart.Name() != filepath.Base(chart.Name()) {
+		return fmt.Errorf("%q is not a valid chart name", chart.Name())
+	}
+
 	o, err := os.MkdirTemp("", "chart-build-*")
 	if err != nil {
 		return fmt.Errorf("failed to create temporary directory for chart: %w", err)

internal/helm/chart/builder_test.go

@@ -113,6 +113,15 @@ func TestRemoteReference_Validate(t *testing.T) {
 			ref:     RemoteReference{Name: "not//a/valid/chart"},
 			wantErr: "invalid chart name 'not//a/valid/chart'",
 		},
+		{
+			name: "ref with period in name",
+			ref:  RemoteReference{Name: "valid.chart.name"},
+		},
+		{
+			name:    "ref with double period in name",
+			ref:     RemoteReference{Name: "../valid-chart-name"},
+			wantErr: "invalid chart name '../valid-chart-name",
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -246,6 +255,14 @@ func Test_packageToPath(t *testing.T) {
 	g.Expect(out).To(BeARegularFile())
 	_, err = secureloader.LoadFile(out)
 	g.Expect(err).ToNot(HaveOccurred())
+
+	chart, err = secureloader.LoadFile("../testdata/charts/helmchart-badname-0.1.0.tgz")
+	g.Expect(err).ToNot(HaveOccurred())
+	g.Expect(chart).ToNot(BeNil())
+
+	out2 := tmpFile("chart-badname-0.1.0", ".tgz")
+	err = packageToPath(chart, out2)
+	g.Expect(err).To(HaveOccurred())
 }
 
 func tmpFile(prefix, suffix string) string {