fix: validate tag before build using OCI regex (#3191)

Sources: * https://github.com/opencontainers/distribution-spec * https://docs.docker.com/engine/reference/commandline/tag/ Closes #3153. --------- Signed-off-by: Daniel Lombardi <[email protected]>
docker · Dec 5, 2023 · a9b5494 · a9b5494
1 parent cb8f2c6
commit a9b5494
Show file tree

Hide file tree

Showing 4 changed files with 157 additions and 119 deletions.
diff --git a/docker/api/build.py b/docker/api/build.py
@@ -129,13 +129,16 @@ def build(self, path=None, tag=None, quiet=False, fileobj=None,
             raise errors.DockerException(
                 'Can not use custom encoding if gzip is enabled'
             )
-
+        if tag is not None:
+            if not utils.match_tag(tag):
+                raise errors.DockerException(
+                    f"invalid tag '{tag}': invalid reference format"
+            )
         for key in container_limits.keys():
             if key not in constants.CONTAINER_LIMITS_KEYS:
                 raise errors.DockerException(
-                    f'Invalid container_limits key {key}'
+                    f"invalid tag '{tag}': invalid reference format"
                 )
-
         if custom_context:
             if not fileobj:
                 raise TypeError("You must specify fileobj with custom_context")

diff --git a/docker/utils/__init__.py b/docker/utils/__init__.py
@@ -1,5 +1,5 @@
 
-from .build import create_archive, exclude_paths, mkbuildcontext, tar
+from .build import match_tag, create_archive, exclude_paths, mkbuildcontext, tar
 from .decorators import check_resource, minimum_version, update_headers
 from .utils import (
     compare_version, convert_port_bindings, convert_volume_binds,

diff --git a/docker/utils/build.py b/docker/utils/build.py
@@ -9,6 +9,14 @@
 
 
 _SEP = re.compile('/|\\\\') if IS_WINDOWS_PLATFORM else re.compile('/')
+_TAG = re.compile(
+    r"^[a-z0-9]+((\.|_|__|-+)[a-z0-9]+)*(\/[a-z0-9]+((\.|_|__|-+)[a-z0-9]+)*)*" \
+        + "(:[a-zA-Z0-9_][a-zA-Z0-9._-]{0,127})?$"
+)
+
+
+def match_tag(tag: str) -> bool:
+    return bool(_TAG.match(tag))
 
 
 def tar(path, exclude=None, dockerfile=None, fileobj=None, gzip=False):