From 5de5d7ce61b2eabf6ad9aca8d89219b558c2570d Mon Sep 17 00:00:00 2001
From: Simon Warta <simon@warta.it>
Date: Mon, 2 Mar 2020 12:14:47 +0100
Subject: [PATCH] Add max length and min name components to isValidBuilder

---
 packages/sdk/src/builder.spec.ts | 31 +++++++++++++++----------------
 packages/sdk/src/builder.ts      |  6 +++++-
 2 files changed, 20 insertions(+), 17 deletions(-)

diff --git a/packages/sdk/src/builder.spec.ts b/packages/sdk/src/builder.spec.ts
index d83cbb9a..20926f4c 100644
--- a/packages/sdk/src/builder.spec.ts
+++ b/packages/sdk/src/builder.spec.ts
@@ -9,13 +9,6 @@ describe("builder", () => {
       expect(isValidBuilder("myorg/super-optimizer:42")).toEqual(true);
     });
 
-    it("supports images with no organization", () => {
-      // from https://hub.docker.com/_/ubuntu
-      expect(isValidBuilder("ubuntu:xenial-20200212")).toEqual(true);
-      // from https://hub.docker.com/_/rust
-      expect(isValidBuilder("rust:1.40.0")).toEqual(true);
-    });
-
     it("supports images with multi level names", () => {
       expect(isValidBuilder("myorg/department-x/office-y/technology-z/super-optimizer:0.1.2")).toEqual(true);
     });
@@ -25,15 +18,6 @@ describe("builder", () => {
       expect(isValidBuilder("myorg/super-optimizer:0.1.2-Alpha")).toEqual(true);
     });
 
-    it("allows very long images", () => {
-      // This is > 2 KiB of data
-      expect(
-        isValidBuilder(
-          "myorgisnicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenice/super-optimizer:42",
-        ),
-      ).toEqual(true);
-    });
-
     // Invalid cases
 
     it("returns false for missing or empty tag", () => {
@@ -60,5 +44,20 @@ describe("builder", () => {
       expect(isValidBuilder("mYorg/super-optimizer:42")).toEqual(false);
       expect(isValidBuilder("myorg/super-Optimizer:42")).toEqual(false);
     });
+
+    it("returns false for long images", () => {
+      expect(
+        isValidBuilder(
+          "myorgisnicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenicenice/super-optimizer:42",
+        ),
+      ).toEqual(false);
+    });
+
+    it("returns false for images with no organization", () => {
+      // Those are valid dockerhub images from https://hub.docker.com/_/ubuntu and https://hub.docker.com/_/rust
+      // but not valid in the context of CosmWasm Verify
+      expect(isValidBuilder("ubuntu:xenial-20200212")).toEqual(false);
+      expect(isValidBuilder("rust:1.40.0")).toEqual(false);
+    });
   });
 });
diff --git a/packages/sdk/src/builder.ts b/packages/sdk/src/builder.ts
index 422aca86..31a790c7 100644
--- a/packages/sdk/src/builder.ts
+++ b/packages/sdk/src/builder.ts
@@ -8,9 +8,13 @@
 // A tag name must be valid ASCII and may contain lowercase and uppercase letters, digits, underscores, periods and dashes.
 // A tag name may not start with a period or a dash and may contain a maximum of 128 characters.
 const dockerImagePattern = new RegExp(
-  "^[a-z0-9][a-z0-9._-]*[a-z0-9](/[a-z0-9][a-z0-9._-]*[a-z0-9])*:[a-zA-Z0-9_][a-zA-Z0-9_.-]{0,127}$",
+  "^[a-z0-9][a-z0-9._-]*[a-z0-9](/[a-z0-9][a-z0-9._-]*[a-z0-9])+:[a-zA-Z0-9_][a-zA-Z0-9_.-]{0,127}$",
 );
 
+/** Max length in bytes/characters (regexp enforces all ASCII, even if that is not required by the standard) */
+const builderMaxLength = 128;
+
 export function isValidBuilder(builder: string): boolean {
+  if (builder.length > builderMaxLength) return false;
   return !!builder.match(dockerImagePattern);
 }