Actions
Issue #8303
closed
push of an image that contains foreign layers should not succeed
Start date:
Due date:
Estimated time:
Severity:
2. Medium
Platform Release:
OS:
Triaged:
Yes
Groomed:
No
Sprint Candidate:
No
Tags:
Sprint:
Sprint 109
Quarter:
Description
https://github.com/pulp/pulp_container/blob/2.3/pulp_container/app/registry_api.py#L459
Our upload logic does not seem to check on the type of the blob that is being uploaded. Foreign layers should be rejected. We should check on the content_type provided in the request.
We should audit manifests too.
https://github.com/pulp/pulp_container/blob/2.3/pulp_container/app/registry_api.py#L576
Actions
.
Fixed blob content_type headers and added blob/manifest validation.
closes #9571 closes #8303