If Dockerfile exists in same directory as service, we should not use it. #12092
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: rhatdan The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
We should only use the Containerfiles/Dockerfiles found in the context directory. Fixes: containers#12054 [NO NEW TESTS NEEDED] It is difficult to setup a test for this in the CI/CD system, but build tests should find if this PR broke anything. Signed-off-by: Daniel J Walsh <[email protected]>
| @@ -151,22 +151,19 @@ func BuildImage(w http.ResponseWriter, r *http.Request) { | |||
| var m = []string{} | |||
| if err := json.Unmarshal([]byte(query.Dockerfile), &m); err != nil { | |||
| // it's not json, assume just a string | |||
| m = append(m, query.Dockerfile) | |||
| m = []string{filepath.Join(contextDirectory, query.Dockerfile)} | |||
There was a problem hiding this comment.
is contextDirectory secure at this point? Could someone somehow mess with it to insert some bizarre symlink to create a security issue?
There was a problem hiding this comment.
Well we do this all over the place, Bottom line if you can talk to this API, you can get it to do stuff with the server privs. Passing a bad contextDirectory is the least of the problems in that case.
|
/lgtm |
github-actions
bot
added
the
locked - please file new issue/PR
We should only use the Containerfiles/Dockerfiles found in the context
directory.
Fixes: #12054
[NO NEW TEST NEEDED] It is difficult to setup a test for this in the
CI/CD system, but build tests should find if this PR broke anything.
Signed-off-by: Daniel J Walsh [email protected]
What this PR does / why we need it:
How to verify it
Which issue(s) this PR fixes:
Special notes for your reviewer: