testcontainers-java icon indicating copy to clipboard operation
testcontainers-java copied to clipboard

fix: Don't return JSON auth config for partial registry name match

Open kiview opened this issue 3 years ago • 1 comments

With the current implementation, looking up the JSON file based auth config for an image registry.example.co/org/repo would return the auth config for https://registry.example.com (note the missing m from the TLD of the image name).

I can not think of a case where this is a desired behavior and in addition, this could be a potential part in a more sophisticated exploit chain (although I don't expect this to be likely for Testcontainers usage scenarios).

This implementation mitigates this issue by ensuring that the parsed repository name has to exactly match the string of the registry following the protocol (http(s)://).

kiview avatar Dec 23 '22 14:12 kiview

/cc @cristianrgreco

HofmeisterAn avatar Dec 23 '22 14:12 HofmeisterAn