mirror of
https://github.com/kubernetes-sigs/kustomize.git
synced 2026-09-15 12:18:57 +00:00
d32ba3f38c
IsImageMatched interpolates the image name from kustomization images[].name straight into a regexp and discarded the compile error. When the name is not a valid regexp (for example "["), regexp.Compile returns a nil *Regexp and the following MatchString call dereferences it, so kustomize build crashes with a SIGSEGV. Capture the compile error and return false when it is set. A name that can't compile matches no image, which leaves the resource untouched (the same result you get for any name that doesn't match). Adds a unit test for the invalid name and a krusty end-to-end case that builds without panicking. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
81 lines
2.5 KiB
Go
81 lines
2.5 KiB
Go
// Copyright 2020 The Kubernetes Authors.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package image
|
|
|
|
import (
|
|
"regexp"
|
|
"strings"
|
|
)
|
|
|
|
// IsImageMatched returns true if the value of t is identical to the
|
|
// image name in the full image name and tag as given by s.
|
|
func IsImageMatched(s, t string) bool {
|
|
// Tag values are limited to [a-zA-Z0-9_.{}-].
|
|
// Some tools like Bazel rules_k8s allow tag patterns with {} characters.
|
|
// More info: https://github.com/bazelbuild/rules_k8s/pull/423
|
|
//
|
|
// The digest algorithm is matched following the OCI grammar
|
|
// (algorithm-component separated by one of [+._-], e.g. sha256, sha512,
|
|
// multihash+base58) rather than hard-coded to sha256, so that references
|
|
// using any OCI-valid digest algorithm match consistently with Split,
|
|
// which accepts any algorithm.
|
|
// See https://github.com/opencontainers/image-spec/blob/main/descriptor.md#digests
|
|
// The name t comes from kustomization images[].name and is interpolated
|
|
// into the pattern directly, so it can be an invalid regexp (for example
|
|
// "["). When it fails to compile, treat it as matching nothing rather than
|
|
// dereferencing a nil *Regexp, which would panic during the build.
|
|
pattern, err := regexp.Compile("^" + t + "(:[a-zA-Z0-9_.{}-]*)?(@[a-zA-Z0-9]+([.+_-][a-zA-Z0-9]+)*:[a-zA-Z0-9_.{}-]*)?$")
|
|
if err != nil {
|
|
return false
|
|
}
|
|
return pattern.MatchString(s)
|
|
}
|
|
|
|
// Split separates and returns the name and tag parts
|
|
// from the image string using either colon `:` or at `@` separators.
|
|
// image reference pattern: [[host[:port]/]component/]component[:tag][@digest]
|
|
func Split(imageName string) (name string, tag string, digest string) {
|
|
// check if image name contains a domain
|
|
// if domain is present, ignore domain and check for `:`
|
|
searchName := imageName
|
|
slashIndex := strings.Index(imageName, "/")
|
|
if slashIndex > 0 {
|
|
searchName = imageName[slashIndex:]
|
|
} else {
|
|
slashIndex = 0
|
|
}
|
|
|
|
id := strings.Index(searchName, "@")
|
|
ic := strings.Index(searchName, ":")
|
|
|
|
// no tag or digest
|
|
if ic < 0 && id < 0 {
|
|
return imageName, "", ""
|
|
}
|
|
|
|
// digest only
|
|
if id >= 0 && (id < ic || ic < 0) {
|
|
id += slashIndex
|
|
name = imageName[:id]
|
|
digest = strings.TrimPrefix(imageName[id:], "@")
|
|
return name, "", digest
|
|
}
|
|
|
|
// tag and digest
|
|
if id >= 0 && ic >= 0 {
|
|
id += slashIndex
|
|
ic += slashIndex
|
|
name = imageName[:ic]
|
|
tag = strings.TrimPrefix(imageName[ic:id], ":")
|
|
digest = strings.TrimPrefix(imageName[id:], "@")
|
|
return name, tag, digest
|
|
}
|
|
|
|
// tag only
|
|
ic += slashIndex
|
|
name = imageName[:ic]
|
|
tag = strings.TrimPrefix(imageName[ic:], ":")
|
|
return name, tag, ""
|
|
}
|