fix: bound tag and referrer list pagination to prevent unbounded requests#1215
Merged
TerryHowe merged 1 commit intoJul 2, 2026
Merged
Conversation
…ests Tag and referrer listing follow the server-provided Link: rel="next" header until the registry stops sending one, with no cap on the number of pages. A malicious or misbehaving registry can advertise an endless chain of pages (including a self-referential next link) and force the client into unbounded requests and resource consumption, a client-side denial of service. Add TagListMaxPages and ReferrerListMaxPages to Repository so callers can bound the number of pages followed during tag and referrer listing. When the limit is exceeded the listing returns errdef.ErrTooManyPages. Zero, the default, means unlimited and preserves existing behavior. Refs GHSA-298f-872v-2rcx Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Terry Howe <terrylhowe@gmail.com>
TerryHowe
requested review from
Wwwsylvia,
sabre1041 and
shizhMSFT
as code owners
June 11, 2026 20:56
Merged
TerryHowe
added a commit
that referenced
this pull request
Jul 10, 2026
This is a security patch release addressing advisories in the content and remote layers, plus additional hardening and bug fixes since v2.6.1. ## Security Fixes - Resolve the hardlink (`TypeLink`) target before passing it to `os.Link`, preventing a crafted OCI artifact from hardlinking a file outside the extraction directory via the process CWD (#1232, [GHSA-fxhp-mv3v-67qp](GHSA-fxhp-mv3v-67qp) / CVE-2026-50163) - Bound tag and referrer list pagination to prevent a malicious or misbehaving registry from advertising an endless page chain and forcing unbounded client requests (client-side DoS) (#1215) ## Bug Fixes - Bound `content.ReadAll` allocation by actual content read rather than the descriptor size, correcting the over-broad 32 MiB cap introduced for GHSA-f36w-mj3v-6jqv so legitimate in-memory `Push`/`FetchAll`/`FetchBytes` are not rejected (#1223) ## Other Changes - Bump `golang.org/x/sync` from 0.20.0 to 0.21.0 (#1208) Signed-off-by: Terry Howe <terrylhowe@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backport of the tag/referrer pagination bound to the v2 line (
oras.land/oras-go/v2).Tag and referrer listing in
Repositoryfollow the server-providedLink: rel="next"header until the registry stops sending one, with no cap on the number of pages. A malicious or misbehaving registry can advertise an endless chain of pages — including a self-referentialnextlink pointing back at the same endpoint — and force the client into unbounded HTTP requests and resource consumption (a client-side denial of service).This is the library-side mitigation for the pagination issue described in GHSA-298f-872v-2rcx.
Changes
TagListMaxPagesandReferrerListMaxPagesfields toRepository(propagated viaclone()), bounding the number of pages followed during tag and referrer listing.Tags()andreferrersByAPI(); when the limit is exceeded, listing returns the newerrdef.ErrTooManyPages.Tests
TestRepository_Tags_MaxPagesandTestRepository_Referrers_MaxPagesdrive anhttptestserver that returns an endlessLinkchain and assert the listing terminates witherrdef.ErrTooManyPages.Notes
This addresses the oras-go (pagination) half of GHSA-298f-872v-2rcx. The advisory also describes a recursive
oras discovergraph traversal issue, which lives in the oras CLI rather than this library. The equivalent change for the development line is in #1214.🤖 Generated with Claude Code