mirror of
https://github.com/apple/container.git
synced 2026-10-16 02:59:21 +00:00
c0185aea5c
This PR fixes a number of issues: - validate descriptor digests before filesystem use - validate container and exec ids before building paths in ManagedContainer - Check for attribute length when consuming extended attributes in ContainerizationEXT4 - Check directory name length when formatting an ext4 fs - Prevent OCI image layout load from reading host files through a symlink - Validate registry auth realm before exchanging credentials --------- Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com> Co-authored-by: John Logan <john_logan@apple.com> Co-authored-by: Raj Aryan Singh <rajaryan_singh@apple.com> Co-authored-by: Raj <realrajaryan@gmail.com>
36 lines
1.7 KiB
Swift
36 lines
1.7 KiB
Swift
//===----------------------------------------------------------------------===//
|
|
// Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// https://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
extension String {
|
|
/// Removes any prefix (sha256:) from a digest string.
|
|
///
|
|
/// - Warning: This performs **no validation** despite its name. For
|
|
/// `sha256:../../etc/hosts` it returns `../../etc/hosts`, and for a string
|
|
/// with no colon, or more than one, it returns the input unchanged. It must
|
|
/// never be used to build a filesystem path from a digest that came from a
|
|
/// registry or an on-disk image layout — use ``validatedDigestEncoding()``,
|
|
/// which rejects anything that is not a well formed digest, or
|
|
/// ``ParsedDigest/path(in:)`` to resolve one to a path.
|
|
@available(*, deprecated, message: "Does not validate. Use validatedDigestEncoding() for paths, or SHA256.Digest.encoded for a computed hash.")
|
|
public var trimmingDigestPrefix: String {
|
|
let split = self.split(separator: ":")
|
|
if split.count == 2 {
|
|
return String(split[1])
|
|
}
|
|
return self
|
|
}
|
|
}
|