Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix/Add hostname check in registry URL on login #5055

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
+11 −0
Draft

fix/Add hostname check in registry URL on login #5055

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 11 additions & 0 deletions cli/command/registry/login.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ import (
"context"
"fmt"
"io"
"net/url"
"strings"

"github.com/docker/cli/cli"
Expand Down Expand Up @@ -97,6 +98,16 @@ func verifyloginOptions(dockerCli command.Cli, opts *loginOptions) error {
opts.password = strings.TrimSuffix(string(contents), "\n")
opts.password = strings.TrimSuffix(opts.password, "\r")
}

if opts.serverAddress != "" {
u, err := url.Parse(opts.serverAddress)
if err != nil {
return errors.Errorf("Invalid server address: %s", opts.serverAddress)
}
if u.Host == "" {
return errors.Errorf("Server address must include a hostname: %s", opts.serverAddress)
}
}
Comment on lines +102 to +110
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure this change is correct; the expected argument is the hostname[:port] of the registry (so only a hostname, and optionally a port). I think the fact it accepts a scheme may be an accidental side-effect of how it's handled further on, but this change likely will break "correct" cases, e.g. docker login docker.io or docker login example.com:5000.

That said; there's definitely ambiguity in some of these areas, so we need to better define these.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

net/url, in accordance with RFC3986, accepts and processes all variations of URLs, including those with or without a scheme and hostname. However, in our case, the hostname is mandatory since it is the only component used for login in the subsequent code. The issue is not the presence of a scheme; the problem lies in the fact that even '/host' is considered a valid URL not related to 'defaultRegistry'. As a result, at the stage indicated in https://github.com/docker/cli/blob/master/cli/command/registry.go#L66, the program follows the wrong path

return nil
}

Expand Down