We need to scan the oras-go code base to identify and fix any instances where an unregistered algorithm could cause a panic.
I just found an instance:
|
// NewVerifyReader wraps r for reading content with verification against desc. |
|
func NewVerifyReader(r io.Reader, desc ocispec.Descriptor) *VerifyReader { |
|
verifier := desc.Digest.Verifier() |
|
lr := &io.LimitedReader{ |
|
R: io.TeeReader(r, verifier), |
|
N: desc.Size, |
|
} |
|
return &VerifyReader{ |
|
base: lr, |
|
verifier: verifier, |
|
} |
|
} |
In this function, if the algorithm used in the digest is unregistered, line 102 will panic.
I also tested OCIStore.Fetch(), Repository.Fetch(), and Repository.FetchReference(). I observed that if there is an unsupported digest type is returned in the "Docker-Content-Digest" header, oras-go will return an error instead of panicking.
We need to scan the
oras-gocode base to identify and fix any instances where an unregistered algorithm could cause a panic.I just found an instance:
oras-go/content/reader.go
Lines 100 to 111 in d92df9d
In this function, if the algorithm used in the digest is unregistered, line 102 will panic.
I also tested
OCIStore.Fetch(),Repository.Fetch(), andRepository.FetchReference(). I observed that if there is an unsupported digest type is returned in the"Docker-Content-Digest"header,oras-gowill return an error instead of panicking.