{"action":"created","comment":{"url":"https://api.github.com/repos/docker/docker/pulls/comments/89395992","pull_request_review_id":9941892,"id":89395992,"diff_hunk":"@@ -8,6 +8,12 @@ import (\n \t\"path/filepath\"\n \n \t\"github.com/docker/docker/api/types\"\n+\t\"github.com/docker/docker/utils\"\n+)\n+\n+var (\n+\tvalidCheckpointNameChars   = utils.RestrictedNameChars\n+\tvalidCheckpointNamePattern = utils.RestrictedNamePattern","path":"daemon/checkpoint.go","position":9,"original_position":9,"commit_id":"839e405965a685b04a0f4b37781b946d97c2f6ee","original_commit_id":"839e405965a685b04a0f4b37781b946d97c2f6ee","user":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars.githubusercontent.com/u/1804568?v=3","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"body":"I just realized `RestrictedNamePattern` is originally created for containers, and allows a leading `/` https://github.com/docker/docker/blob/b248de7e332b6e67b08a8981f68060e6ae629ccf/utils/names.go#L8-L9. \r\n\r\nSo this is still \"valid\" with this change;\r\n\r\n```bash\r\ndocker checkpoint create my-container /out-of-jail\r\n```\r\n\r\nThe name is misleading, and so is the description. Perhaps we should rename that pattern to `RestrictedContainerNamePattern`\r\n\r\nOr (maybe better); remove the leading `/` from that check, and change the check for container names here; https://github.com/docker/docker/blob/b248de7e332b6e67b08a8981f68060e6ae629ccf/daemon/names.go#L61\r\n\r\nto\r\n\r\n```go\r\nif !validContainerNamePattern.MatchString(strings.TrimPrefix(name, \"/')) {\r\n   ...\r\n}\r\n```\r\n\r\nIf we do so, \r\nwe can remove the  `RestrictedVolumeNamePattern` https://github.com/docker/docker/blob/b248de7e332b6e67b08a8981f68060e6ae629ccf/utils/names.go#L11-L12\r\n\r\nAnd use `RestrictedNamePattern` as a default pattern for all objects\r\n\r\n@tiborvass wdyt?","created_at":"2016-11-23T20:42:58Z","updated_at":"2016-11-23T20:42:58Z","html_url":"https://github.com/docker/docker/pull/28772#discussion_r89395992","pull_request_url":"https://api.github.com/repos/docker/docker/pulls/28772","_links":{"self":{"href":"https://api.github.com/repos/docker/docker/pulls/comments/89395992"},"html":{"href":"https://github.com/docker/docker/pull/28772#discussion_r89395992"},"pull_request":{"href":"https://api.github.com/repos/docker/docker/pulls/28772"}}},"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/28772","id":95070677,"html_url":"https://github.com/docker/docker/pull/28772","diff_url":"https://github.com/docker/docker/pull/28772.diff","patch_url":"https://github.com/docker/docker/pull/28772.patch","issue_url":"https://api.github.com/repos/docker/docker/issues/28772","number":28772,"state":"open","locked":false,"title":"Restrict checkpoint name to prevent directory traversal","user":{"login":"yongtang","id":6932348,"avatar_url":"https://avatars.githubusercontent.com/u/6932348?v=3","gravatar_id":"","url":"https://api.github.com/users/yongtang","html_url":"https://github.com/yongtang","followers_url":"https://api.github.com/users/yongtang/followers","following_url":"https://api.github.com/users/yongtang/following{/other_user}","gists_url":"https://api.github.com/users/yongtang/gists{/gist_id}","starred_url":"https://api.github.com/users/yongtang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yongtang/subscriptions","organizations_url":"https://api.github.com/users/yongtang/orgs","repos_url":"https://api.github.com/users/yongtang/repos","events_url":"https://api.github.com/users/yongtang/events{/privacy}","received_events_url":"https://api.github.com/users/yongtang/received_events","type":"User","site_admin":false},"body":"**- What I did**\r\n\r\nThis fix tries to address the issue raised in #28769 where checkpoint name was not checked before passing to containerd. As a result, it was possible to use a special checkpoint name to get outside of the container's directory.\r\n\r\n**- How I did it**\r\n\r\nThis fix add restriction `[a-zA-Z0-9][a-zA-Z0-9_.-]+` (`RestrictedNamePattern`). This is the same as container name restriction.\r\n\r\n**- How to verify it**\r\n\r\n```\r\nubuntu@ubuntu:~$ docker run -d --name my-container nginx:alpine\r\nUnable to find image 'nginx:alpine' locally\r\nalpine: Pulling from library/nginx\r\n3690ec4760f9: Already exists \r\ne13b170882f4: Pull complete \r\n6a5d3c1484a0: Pull complete \r\nf421a9935a76: Pull complete \r\nDigest: sha256:5c6be3514a00db611371806c5aeb510dfd285a4b8261c6e5c3323387e396b66b\r\nStatus: Downloaded newer image for nginx:alpine\r\n43719e0c65c60a679b1fa01a86d6e2433b4246349b92fa127275931207667639\r\nubuntu@ubuntu:~$ docker checkpoint create my-container ../../out-of-jail\r\nError response from daemon: Invalid checkpoint ID (../../out-of-jail), only [a-zA-Z0-9][a-zA-Z0-9_.-] are allowed\r\n```\r\n**- Description for the changelog**\r\n\r\n\r\n**- A picture of a cute animal (not mandatory but encouraged)**\r\n\r\nThis fix fixes #28769.\r\n\r\nSigned-off-by: Yong Tang <yong.tang.github@outlook.com>","created_at":"2016-11-23T20:02:03Z","updated_at":"2016-11-23T20:43:38Z","closed_at":null,"merged_at":null,"merge_commit_sha":"01614ab9b5318e88ef7936726a0e4145510597ba","assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/docker/docker/milestones/56","html_url":"https://github.com/docker/docker/milestones/1.13.0","labels_url":"https://api.github.com/repos/docker/docker/milestones/56/labels","id":1839404,"number":56,"title":"1.13.0","description":"","creator":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars.githubusercontent.com/u/1804568?v=3","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"open_issues":115,"closed_issues":986,"state":"open","created_at":"2016-06-20T22:51:25Z","updated_at":"2016-11-23T20:29:55Z","due_on":null,"closed_at":null},"commits_url":"https://api.github.com/repos/docker/docker/pulls/28772/commits","review_comments_url":"https://api.github.com/repos/docker/docker/pulls/28772/comments","review_comment_url":"https://api.github.com/repos/docker/docker/pulls/comments{/number}","comments_url":"https://api.github.com/repos/docker/docker/issues/28772/comments","statuses_url":"https://api.github.com/repos/docker/docker/statuses/839e405965a685b04a0f4b37781b946d97c2f6ee","head":{"label":"yongtang:28769-checkpoint-id-name-check","ref":"28769-checkpoint-id-name-check","sha":"839e405965a685b04a0f4b37781b946d97c2f6ee","user":{"login":"yongtang","id":6932348,"avatar_url":"https://avatars.githubusercontent.com/u/6932348?v=3","gravatar_id":"","url":"https://api.github.com/users/yongtang","html_url":"https://github.com/yongtang","followers_url":"https://api.github.com/users/yongtang/followers","following_url":"https://api.github.com/users/yongtang/following{/other_user}","gists_url":"https://api.github.com/users/yongtang/gists{/gist_id}","starred_url":"https://api.github.com/users/yongtang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yongtang/subscriptions","organizations_url":"https://api.github.com/users/yongtang/orgs","repos_url":"https://api.github.com/users/yongtang/repos","events_url":"https://api.github.com/users/yongtang/events{/privacy}","received_events_url":"https://api.github.com/users/yongtang/received_events","type":"User","site_admin":false},"repo":{"id":53518876,"name":"docker","full_name":"yongtang/docker","owner":{"login":"yongtang","id":6932348,"avatar_url":"https://avatars.githubusercontent.com/u/6932348?v=3","gravatar_id":"","url":"https://api.github.com/users/yongtang","html_url":"https://github.com/yongtang","followers_url":"https://api.github.com/users/yongtang/followers","following_url":"https://api.github.com/users/yongtang/following{/other_user}","gists_url":"https://api.github.com/users/yongtang/gists{/gist_id}","starred_url":"https://api.github.com/users/yongtang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yongtang/subscriptions","organizations_url":"https://api.github.com/users/yongtang/orgs","repos_url":"https://api.github.com/users/yongtang/repos","events_url":"https://api.github.com/users/yongtang/events{/privacy}","received_events_url":"https://api.github.com/users/yongtang/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/yongtang/docker","description":"Docker - the open-source application container engine","fork":true,"url":"https://api.github.com/repos/yongtang/docker","forks_url":"https://api.github.com/repos/yongtang/docker/forks","keys_url":"https://api.github.com/repos/yongtang/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/yongtang/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/yongtang/docker/teams","hooks_url":"https://api.github.com/repos/yongtang/docker/hooks","issue_events_url":"https://api.github.com/repos/yongtang/docker/issues/events{/number}","events_url":"https://api.github.com/repos/yongtang/docker/events","assignees_url":"https://api.github.com/repos/yongtang/docker/assignees{/user}","branches_url":"https://api.github.com/repos/yongtang/docker/branches{/branch}","tags_url":"https://api.github.com/repos/yongtang/docker/tags","blobs_url":"https://api.github.com/repos/yongtang/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/yongtang/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/yongtang/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/yongtang/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/yongtang/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/yongtang/docker/languages","stargazers_url":"https://api.github.com/repos/yongtang/docker/stargazers","contributors_url":"https://api.github.com/repos/yongtang/docker/contributors","subscribers_url":"https://api.github.com/repos/yongtang/docker/subscribers","subscription_url":"https://api.github.com/repos/yongtang/docker/subscription","commits_url":"https://api.github.com/repos/yongtang/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/yongtang/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/yongtang/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/yongtang/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/yongtang/docker/contents/{+path}","compare_url":"https://api.github.com/repos/yongtang/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/yongtang/docker/merges","archive_url":"https://api.github.com/repos/yongtang/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/yongtang/docker/downloads","issues_url":"https://api.github.com/repos/yongtang/docker/issues{/number}","pulls_url":"https://api.github.com/repos/yongtang/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/yongtang/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/yongtang/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/yongtang/docker/labels{/name}","releases_url":"https://api.github.com/repos/yongtang/docker/releases{/id}","deployments_url":"https://api.github.com/repos/yongtang/docker/deployments","created_at":"2016-03-09T17:51:45Z","updated_at":"2016-03-09T17:51:56Z","pushed_at":"2016-11-23T19:56:35Z","git_url":"git://github.com/yongtang/docker.git","ssh_url":"git@github.com:yongtang/docker.git","clone_url":"https://github.com/yongtang/docker.git","svn_url":"https://github.com/yongtang/docker","homepage":"http://www.docker.com","size":109242,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":0,"forks":1,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"docker:master","ref":"master","sha":"1640bb23b1127b76c4f0bf97bb265238b7574da9","user":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"repo":{"id":7691631,"name":"docker","full_name":"docker/docker","owner":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/docker/docker","description":"Docker - the open-source application container engine","fork":false,"url":"https://api.github.com/repos/docker/docker","forks_url":"https://api.github.com/repos/docker/docker/forks","keys_url":"https://api.github.com/repos/docker/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/docker/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/docker/docker/teams","hooks_url":"https://api.github.com/repos/docker/docker/hooks","issue_events_url":"https://api.github.com/repos/docker/docker/issues/events{/number}","events_url":"https://api.github.com/repos/docker/docker/events","assignees_url":"https://api.github.com/repos/docker/docker/assignees{/user}","branches_url":"https://api.github.com/repos/docker/docker/branches{/branch}","tags_url":"https://api.github.com/repos/docker/docker/tags","blobs_url":"https://api.github.com/repos/docker/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/docker/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/docker/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/docker/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/docker/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/docker/docker/languages","stargazers_url":"https://api.github.com/repos/docker/docker/stargazers","contributors_url":"https://api.github.com/repos/docker/docker/contributors","subscribers_url":"https://api.github.com/repos/docker/docker/subscribers","subscription_url":"https://api.github.com/repos/docker/docker/subscription","commits_url":"https://api.github.com/repos/docker/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/docker/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/docker/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/docker/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/docker/docker/contents/{+path}","compare_url":"https://api.github.com/repos/docker/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/docker/docker/merges","archive_url":"https://api.github.com/repos/docker/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/docker/docker/downloads","issues_url":"https://api.github.com/repos/docker/docker/issues{/number}","pulls_url":"https://api.github.com/repos/docker/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/docker/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/docker/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/docker/docker/labels{/name}","releases_url":"https://api.github.com/repos/docker/docker/releases{/id}","deployments_url":"https://api.github.com/repos/docker/docker/deployments","created_at":"2013-01-18T18:10:57Z","updated_at":"2016-11-23T20:15:36Z","pushed_at":"2016-11-23T20:29:55Z","git_url":"git://github.com/docker/docker.git","ssh_url":"git@github.com:docker/docker.git","clone_url":"https://github.com/docker/docker.git","svn_url":"https://github.com/docker/docker","homepage":"http://www.docker.com","size":233529,"stargazers_count":37153,"watchers_count":37153,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":11005,"mirror_url":null,"open_issues_count":1960,"forks":11005,"open_issues":1960,"watchers":37153,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/docker/docker/pulls/28772"},"html":{"href":"https://github.com/docker/docker/pull/28772"},"issue":{"href":"https://api.github.com/repos/docker/docker/issues/28772"},"comments":{"href":"https://api.github.com/repos/docker/docker/issues/28772/comments"},"review_comments":{"href":"https://api.github.com/repos/docker/docker/pulls/28772/comments"},"review_comment":{"href":"https://api.github.com/repos/docker/docker/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/docker/docker/pulls/28772/commits"},"statuses":{"href":"https://api.github.com/repos/docker/docker/statuses/839e405965a685b04a0f4b37781b946d97c2f6ee"}}}}
{"actor":{"display_login":"thaJeztah"}}