Stephen J Day 29fa466deb registry/{storage,handlers}: limit content sizes ... Under certain circumstances, the use of `StorageDriver.GetContent` can result in unbounded memory allocations. In particualr, this happens when accessing a layer through the manifests endpoint. This problem is mitigated by setting a 4MB limit when using to access content that may have been accepted from a user. In practice, this means setting the limit with the use of `BlobProvider.Get` by wrapping `StorageDriver.GetContent` in a helper that uses `StorageDriver.Reader` with a `limitReader` that returns an error. When mitigating this security issue, we also noticed that the size of manifests uploaded to the registry is also unlimited. We apply similar logic to the request body of payloads that are full buffered. Signed-off-by: Stephen J Day <stephen.day@docker.com> (cherry picked from commit 55ea440428) Signed-off-by: Stephen J Day <stephen.day@docker.com>		2017-07-20 13:37:43 -07:00
..
api_test.go	Add shutdown to test environment	2016-08-26 16:23:07 -07:00
app.go	Use app.driver.Stat for registry health check	2017-03-21 13:11:58 -07:00
app_test.go	Add shutdown to test environment	2016-08-26 16:23:07 -07:00
basicauth.go	Move registry package into handler package	2015-02-10 17:25:40 -08:00
basicauth_prego14.go	Move registry package into handler package	2015-02-10 17:25:40 -08:00
blob.go	Add an "enabled" parameter under "readonly", and make it as if the mutable handlers don't exist when read-only mode is enabled	2015-09-22 15:49:26 -07:00
blobupload.go	registry/{storage,handlers}: limit content sizes	2017-07-20 13:37:43 -07:00
catalog.go	Stop ErrFinishedWalk from escaping from Repositories walk	2016-08-05 17:21:48 -07:00
context.go	Update auth context keys to use constant	2016-01-28 17:02:09 -08:00
health_test.go	Disable upload purging during test	2016-08-26 16:23:07 -07:00
helpers.go	registry/{storage,handlers}: limit content sizes	2017-07-20 13:37:43 -07:00
hmac.go	handlers: provide better log message on mismatched secret	2016-09-02 15:24:35 -07:00
hmac_test.go	Refactor Blob Service API	2015-05-15 17:05:18 -07:00
hooks.go	Feature: Web Panic Reporting via hooks	2015-05-31 14:21:22 +00:00
images.go	registry/{storage,handlers}: limit content sizes	2017-07-20 13:37:43 -07:00
mail.go	Feature: Web Panic Reporting via hooks	2015-05-31 14:21:22 +00:00
tags.go	Pass through known errors	2016-04-29 23:34:24 +02:00