Validate the tags returned by a registry

Signed-off-by: Miloslav Trmač <[email protected]>
mtrmac · Aug 30, 2024 · 897d4af · 897d4af
1 parent 1daada3
commit 897d4af
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/docker/docker_image.go b/docker/docker_image.go
@@ -87,7 +87,12 @@ func GetRepositoryTags(ctx context.Context, sys *types.SystemContext, ref types.
 		if err = json.NewDecoder(res.Body).Decode(&tagsHolder); err != nil {
 			return nil, err
 		}
-		tags = append(tags, tagsHolder.Tags...)
+		for _, tag := range tagsHolder.Tags {
+			if _, err := reference.WithTag(dr.ref, tag); err != nil { // Ensure the tag does not contain unexpected values
+				return nil, fmt.Errorf("registry returned invalid tag %q: %w", tag, err)
+			}
+			tags = append(tags, tag)
+		}
 
 		link := res.Header.Get("Link")
 		if link == "" {