InTheForest/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2026-01-11 18:51:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

If url includes scheme, urlPath will drop hostname, which would not match the auth check

Browse Source 
Signed-off-by: Jameson Hyde <jameson.hyde@docker.com>
(cherry picked from commit 754fb8d9d03895ae3ab60d2ad778152b0d835206)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
(cherry picked from commit 5282cb25d0)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This commit is contained in:
Jameson Hyde
2018-12-01 11:25:49 -05:00
committed by Paweł Gronowski
parent 4c31251093
commit 754d8f168e
2 changed files with 38 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
pkg/authorization/authz.go
View File

@@ -57,11 +57,11 @@ type Ctx struct {
func isChunked(r *http.Request) bool {
// RFC 7230 specifies that content length is to be ignored if Transfer-Encoding is chunked
if strings.ToLower(r.Header.Get("Transfer-Encoding")) == "chunked" {
if strings.EqualFold(r.Header.Get("Transfer-Encoding"), "chunked") {
return true
}
for _, v := range r.TransferEncoding {
if 0 == strings.Compare(strings.ToLower(v), "chunked") {
if strings.EqualFold(v, "chunked") {
return true
}
}
@@ -163,7 +163,7 @@ func drainBody(body io.ReadCloser) ([]byte, io.ReadCloser, error) {
func isAuthEndpoint(urlPath string) (bool, error) {
// eg www.test.com/v1.24/auth/optional?optional1=something&optional2=something (version optional)
matched, err := regexp.MatchString(`^[^\/]+\/(v\d[\d\.]*\/)?auth.*`, urlPath)
matched, err := regexp.MatchString(`^[^\/]*\/(v\d[\d\.]*\/)?auth.*`, urlPath)
if err != nil {
return false, err
}

35
pkg/authorization/authz_unix_test.go
View File

@@ -259,6 +259,41 @@ func TestSendBody(t *testing.T) {
contentType: "application/json;charset=UTF8",
expected: false,
},
{
url: "www.nothing.com/v1.24/auth/test",
contentType: "application/json;charset=UTF8",
expected: false,
},
{
url: "https://www.nothing.com/v1.24/auth/test",
contentType: "application/json;charset=UTF8",
expected: false,
},
{
url: "http://nothing.com/v1.24/auth/test",
contentType: "application/json;charset=UTF8",
expected: false,
},
{
url: "www.nothing.com/test?p1=/auth",
contentType: "application/json;charset=UTF8",
expected: true,
},
{
url: "http://www.nothing.com/test?p1=/auth",
contentType: "application/json;charset=UTF8",
expected: true,
},
{
url: "www.nothing.com/something/auth",
contentType: "application/json;charset=UTF8",
expected: true,
},
{
url: "https://www.nothing.com/something/auth",
contentType: "application/json;charset=UTF8",
expected: true,
},
}
)