Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Go router doesn't exclude reserved path segments in extractContainerName (cross-language parity)

Aperta
#24 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
76/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
docker, go, rust, typescript
Ambito
api, backend

Direzione di ricerca

Inizia in go/internal/proxy/router.go, in extractContainerName, quindi confronta la gestione dei segmenti riservati in rs/src/proxy.rs e ts/src/proxy.ts. Aggiungi la copertura per DELETE /containers/json e per percorsi riservati simili, quindi verifica che Go sia coerente con il comportamento di Rust e TypeScript senza trattare i segmenti riservati come nomi di container.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Problem

While reviewing the Quint spec's routing table against all three implementations (issue #5), found a cross-language inconsistency in how container names are extracted from the URL path.

Rust (rs/src/proxy.rs) and TypeScript (ts/src/proxy.ts) both explicitly exclude reserved path segments (create, json, exec) from being treated as a container name when parsing /containers/:name/... paths. Go's extractContainerName (go/internal/proxy/router.go) does not.

Concretely: a request like DELETE /containers/json is treated as Allow (unknown-container passthrough) in Go, but falls through to Deny (default-deny) in Rust and TypeScript, because Rust/TS recognize json as a reserved segment rather than a container name.

Impact

Low severity — not exploitable as a privilege escalation on its own (the request would still need to pass all other gates), and not exercised by the Quint model (which doesn't model this specific parsing edge case). But it's a real behavioral difference between the three "equal peer" implementations that could cause confusing/inconsistent behavior depending on which language a deployment uses.

Solution

Update go/internal/proxy/router.go's extractContainerName to exclude the same reserved segments (create, json, exec, and any others Rust/TS already exclude) that Rust and TypeScript already handle, so all three implementations agree on which path segments are container names vs. reserved routing keywords.

Which implementation(s) would this affect?

  • Go

Additional context

Found during the Quint spec review in #5. Confirmed via gh api diff of Router implementations, not by direct testing — recommend adding a unit test case for DELETE /containers/json (and similar) across all three languages once fixed, to catch regressions.

Lingua principale
Rust
Stelle
2
Fork
0
Merge medio
9h 35m
PR unite (30g)
6

Guida per i contributori

Apri la guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di ChainSafe/docker-socket-policy

Tutte le issue di ChainSafe/docker-socket-policy

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.