1. docker
  2. Commit 5282cb25d09db924fa92fdb8fb7a9bd20bb845b7
Browse code

If url includes scheme, urlPath will drop hostname, which would not match the auth check

Signed-off-by: Jameson Hyde <jameson.hyde@docker.com>
(cherry picked from commit 754fb8d9d03895ae3ab60d2ad778152b0d835206)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

Jameson Hyde authored on 2018/12/02 01:25:49
Showing 2 changed files
pkg/authorization/authz.go
History View file @ 5282cb2
... ... 
@@ -57,11 +57,11 @@ type Ctx struct {
57 57
58 58 
 func isChunked(r *http.Request) bool {
59 59 
 	// RFC 7230 specifies that content length is to be ignored if Transfer-Encoding is chunked
60 
-	if strings.ToLower(r.Header.Get("Transfer-Encoding")) == "chunked" {
60 
+	if strings.EqualFold(r.Header.Get("Transfer-Encoding"), "chunked") {
61 61 
 		return true
62 62 
 	}
63 63 
 	for _, v := range r.TransferEncoding {
64 
-		if 0 == strings.Compare(strings.ToLower(v), "chunked") {
64 
+		if strings.EqualFold(v, "chunked") {
65 65 
 			return true
66 66 
 		}
67 67 
 	}
... ... 
@@ -163,7 +163,7 @@ func drainBody(body io.ReadCloser) ([]byte, io.ReadCloser, error) {
163 163
164 164 
 func isAuthEndpoint(urlPath string) (bool, error) {
165 165 
 	// eg www.test.com/v1.24/auth/optional?optional1=something&optional2=something (version optional)
166 
-	matched, err := regexp.MatchString(`^[^\/]+\/(v\d[\d\.]*\/)?auth.*`, urlPath)
166 
+	matched, err := regexp.MatchString(`^[^\/]*\/(v\d[\d\.]*\/)?auth.*`, urlPath)
167 167 
 	if err != nil {
168 168 
 		return false, err
169 169 
 	}
pkg/authorization/authz_unix_test.go
History View file @ 5282cb2
... ... 
@@ -259,6 +259,41 @@ func TestSendBody(t *testing.T) {
259 259 
 				contentType: "application/json;charset=UTF8",
260 260 
 				expected:    false,
261 261 
 			},
262 
+			{
263 
+				url:         "www.nothing.com/v1.24/auth/test",
264 
+				contentType: "application/json;charset=UTF8",
265 
+				expected:    false,
266 
+			},
267 
+			{
268 
+				url:         "https://www.nothing.com/v1.24/auth/test",
269 
+				contentType: "application/json;charset=UTF8",
270 
+				expected:    false,
271 
+			},
272 
+			{
273 
+				url:         "http://nothing.com/v1.24/auth/test",
274 
+				contentType: "application/json;charset=UTF8",
275 
+				expected:    false,
276 
+			},
277 
+			{
278 
+				url:         "www.nothing.com/test?p1=/auth",
279 
+				contentType: "application/json;charset=UTF8",
280 
+				expected:    true,
281 
+			},
282 
+			{
283 
+				url:         "http://www.nothing.com/test?p1=/auth",
284 
+				contentType: "application/json;charset=UTF8",
285 
+				expected:    true,
286 
+			},
287 
+			{
288 
+				url:         "www.nothing.com/something/auth",
289 
+				contentType: "application/json;charset=UTF8",
290 
+				expected:    true,
291 
+			},
292 
+			{
293 
+				url:         "https://www.nothing.com/something/auth",
294 
+				contentType: "application/json;charset=UTF8",
295 
+				expected:    true,
296 
+			},
262 297 
 		}
263 298 
 	)
264 299