Validate the tags returned by a registry

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
containers · May 9, 2024 · b724ee7 · b724ee7
1 parent a9225e4
commit b724ee7
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/docker/docker_image.go b/docker/docker_image.go
@@ -88,7 +88,12 @@ func GetRepositoryTags(ctx context.Context, sys *types.SystemContext, ref types.
 		if err = json.NewDecoder(res.Body).Decode(&tagsHolder); err != nil {
 			return nil, err
 		}
-		tags = append(tags, tagsHolder.Tags...)
+		for _, tag := range tagsHolder.Tags {
+			if _, err := reference.WithTag(dr.ref, tag); err != nil { // Ensure the tag does not contain unexpected values
+				return nil, fmt.Errorf("registry returned invalid tag %q: %w", tag, err)
+			}
+			tags = append(tags, tag)
+		}
 
 		link := res.Header.Get("Link")
 		if link == "" {