Merge pull request moby#5146 from kariya-mitsuru/check-invalid-env-replacement

Check invalid environment replacement form like ${VAR:%}

Author: tonistiigi

frontend/dockerfile/shell/lex.go

@@ -378,6 +378,9 @@ func (sw *shellWord) processDollar() (string, error) {
 		fallthrough
 	case '+', '-', '?', '#', '%':
 		rawEscapes := ch == '#' || ch == '%'
+		if nullIsUnset && rawEscapes {
+			return "", errors.Errorf("unsupported modifier (%s) in substitution", chs)
+		}
 		word, _, err := sw.processStopOn('}', rawEscapes)
 		if err != nil {
 			if sw.scanner.Peek() == scanner.EOF {

frontend/dockerfile/shell/lex_test.go

@@ -497,6 +497,26 @@ func TestProcessWithMatches(t *testing.T) {
 			expected: "xxyy",
 			matches:  map[string]struct{}{"FOO": {}, "BAR": {}},
 		},
+		{
+			input:       "${FOO:#}",
+			envs:        map[string]string{},
+			expectedErr: true,
+		},
+		{
+			input:       "${FOO:##}",
+			envs:        map[string]string{},
+			expectedErr: true,
+		},
+		{
+			input:       "${FOO:%}",
+			envs:        map[string]string{},
+			expectedErr: true,
+		},
+		{
+			input:       "${FOO:%%}",
+			envs:        map[string]string{},
+			expectedErr: true,
+		},
 		{
 			// test: wildcards
 			input:    "${FOO/$NEEDLE/.} - ${FOO//$NEEDLE/.}",