Skip to content

Commit

Permalink
Allow docker version prefixes to contain underscores
Browse files Browse the repository at this point in the history
  • Loading branch information
ryanbrandenburg authored and jakecoffman committed Nov 30, 2023
1 parent 7d595bc commit 650e132
Show file tree
Hide file tree
Showing 3 changed files with 48 additions and 2 deletions.
4 changes: 2 additions & 2 deletions docker/lib/dependabot/docker/tag.rb
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@ class Tag
WORDS_WITH_BUILD = /(?:(?:-[a-z]+)+-[0-9]+)+/
VERSION_REGEX = /v?(?<version>[0-9]+(?:\.[0-9]+)*(?:_[0-9]+|\.[a-z0-9]+|#{WORDS_WITH_BUILD}|-(?:kb)?[0-9]+)*)/i
VERSION_WITH_SFX = /^#{VERSION_REGEX}(?<suffix>-[a-z][a-z0-9.\-]*)?$/i
VERSION_WITH_PFX = /^(?<prefix>[a-z][a-z0-9.\-]*-)?#{VERSION_REGEX}$/i
VERSION_WITH_PFX_AND_SFX = /^(?<prefix>[a-z\-]+-)?#{VERSION_REGEX}(?<suffix>-[a-z\-]+)?$/i
VERSION_WITH_PFX = /^(?<prefix>[a-z][a-z0-9.\-_]*-)?#{VERSION_REGEX}$/i

Check failure

Code scanning / CodeQL

Inefficient regular expression High

This part of the regular expression may cause exponential backtracking on strings starting with '0-a-' and containing many repetitions of '0-a-'.
VERSION_WITH_PFX_AND_SFX = /^(?<prefix>[a-z\-_]+-)?#{VERSION_REGEX}(?<suffix>-[a-z\-]+)?$/i

Check failure

Code scanning / CodeQL

Inefficient regular expression High

This part of the regular expression may cause exponential backtracking on strings starting with '0-a-' and containing many repetitions of '0-a-'.
NAME_WITH_VERSION =
/
#{VERSION_WITH_PFX}|
Expand Down
28 changes: 28 additions & 0 deletions docker/spec/dependabot/docker/file_parser_spec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -462,6 +462,34 @@
end
end

context "with a _ in the tag" do
let(:dockerfile_fixture_name) { "underscore" }

its(:length) { is_expected.to eq(1) }

describe "the first dependency" do
subject(:dependency) { dependencies.first }
let(:expected_requirements) do
[{
requirement: nil,
groups: [],
file: "Dockerfile",
source: {
registry: "registry-host.io:5000",
tag: "someRepo_19700101.4"
}
}]
end

it "has the right details" do
expect(dependency).to be_a(Dependabot::Dependency)
expect(dependency.name).to eq("myreg/ubuntu")
expect(dependency.version).to eq("someRepo_19700101.4")
expect(dependency.requirements).to eq(expected_requirements)
end
end
end

context "with a private registry and a tag" do
let(:dockerfile_fixture_name) { "private_tag" }

Expand Down
18 changes: 18 additions & 0 deletions docker/spec/fixtures/docker/dockerfiles/underscore
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
FROM registry-host.io:5000/myreg/ubuntu:someRepo_19700101.4

### SYSTEM DEPENDENCIES

RUN apt-get update \
&& apt-get upgrade -y \
&& apt-get install -y --no-install-recommends \
build-essential \
dirmngr \
git \

### RUBY

# Install Ruby 2.4
RUN apt-key adv --keyserver keyserver.ubuntu.com --recv-keys C3173AA6 \
&& echo "deb http://ppa.launchpad.net/brightbox/ruby-ng/ubuntu zesty main" > /etc/apt/sources.list.d/brightbox.list \
&& apt-get update
RUN apt-get install -y ruby2.4 ruby2.4-dev

0 comments on commit 650e132

Please sign in to comment.