From 3c9f186060ffb8105324e7d66d7e5f92f9f5c8c6 Mon Sep 17 00:00:00 2001 From: Akanksha Gupta Date: Thu, 30 Jul 2026 22:26:29 -0700 Subject: [PATCH] Validate proxy server image name PiperOrigin-RevId: 956923301 --- .../shared_pathways_service/validators.py | 5 ++++ .../validators_test.py | 24 +++++++++++++++++++ 2 files changed, 29 insertions(+) diff --git a/pathwaysutils/experimental/shared_pathways_service/validators.py b/pathwaysutils/experimental/shared_pathways_service/validators.py index 3a13b25..b93e01d 100644 --- a/pathwaysutils/experimental/shared_pathways_service/validators.py +++ b/pathwaysutils/experimental/shared_pathways_service/validators.py @@ -127,6 +127,11 @@ def validate_proxy_server_image(proxy_server_image: str) -> None: f"Proxy server image '{proxy_server_image}' must contain a tag with ':'" " or a digest with '@'." ) + if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._/:@-]*", proxy_server_image): + raise ValueError( + f"Proxy server image '{proxy_server_image}' contains characters that" + " are not valid in a Docker image reference." + ) def validate_xla_flags(xla_flags: Iterable[str] | None) -> None: diff --git a/pathwaysutils/test/experimental/shared_pathways_service/validators_test.py b/pathwaysutils/test/experimental/shared_pathways_service/validators_test.py index 56897e1..f73d93c 100644 --- a/pathwaysutils/test/experimental/shared_pathways_service/validators_test.py +++ b/pathwaysutils/test/experimental/shared_pathways_service/validators_test.py @@ -252,6 +252,30 @@ def test_validate_proxy_server_image_success(self, image): " with ':' or a digest with '@'." ), ), + dict( + testcase_name="newline_yaml_injection", + image="alpine/alpine:latest\n command: [sh, -c, 'id']", + expected_regex=( + "contains characters that are not valid in a Docker image" + " reference." + ), + ), + dict( + testcase_name="spaces_in_image", + image="gcr.io/project/image:tag extra_args", + expected_regex=( + "contains characters that are not valid in a Docker image" + " reference." + ), + ), + dict( + testcase_name="invalid_punctuation", + image="gcr.io/project/image:tag;echo pwn", + expected_regex=( + "contains characters that are not valid in a Docker image" + " reference." + ), + ), ) def test_validate_proxy_server_image_failure(self, image, expected_regex): """Tests that invalid proxy server image strings raise a ValueError."""