Stephen J Day 55ea440428 registry/{storage,handlers}: limit content sizes ... Under certain circumstances, the use of `StorageDriver.GetContent` can result in unbounded memory allocations. In particualr, this happens when accessing a layer through the manifests endpoint. This problem is mitigated by setting a 4MB limit when using to access content that may have been accepted from a user. In practice, this means setting the limit with the use of `BlobProvider.Get` by wrapping `StorageDriver.GetContent` in a helper that uses `StorageDriver.Reader` with a `limitReader` that returns an error. When mitigating this security issue, we also noticed that the size of manifests uploaded to the registry is also unlimited. We apply similar logic to the request body of payloads that are full buffered. Signed-off-by: Stephen J Day <stephen.day@docker.com>		2017-07-06 17:13:39 -07:00
..
api_test.go	Update handler test to use WithName	2017-01-19 15:21:40 -08:00
app.go	Return early to prevent nil pointer dereference	2017-04-27 14:59:37 +02:00
app_test.go	Change DELETE action from "*" to "delete"	2017-01-03 12:27:12 -08:00
basicauth.go	Move registry package into handler package	2015-02-10 17:25:40 -08:00
basicauth_prego14.go	Move registry package into handler package	2015-02-10 17:25:40 -08:00
blob.go	digest: migrate to opencontainers/go-digest	2017-01-06 15:42:03 -08:00
blobupload.go	registry/{storage,handlers}: limit content sizes	2017-07-06 17:13:39 -07:00
catalog.go	Stop ErrFinishedWalk from escaping from Repositories walk	2016-08-05 17:21:48 -07:00
context.go	register/handlers: remove context manager	2017-04-10 15:27:30 -07:00
health_test.go	Disable upload purging during test	2016-08-26 16:23:07 -07:00
helpers.go	registry/{storage,handlers}: limit content sizes	2017-07-06 17:13:39 -07:00
hmac.go	handlers: provide better log message on mismatched secret	2016-09-02 15:24:35 -07:00
hmac_test.go	Refactor Blob Service API	2015-05-15 17:05:18 -07:00
hooks.go	Feature: Web Panic Reporting via hooks	2015-05-31 14:21:22 +00:00
mail.go	Feature: Web Panic Reporting via hooks	2015-05-31 14:21:22 +00:00
manifests.go	registry/{storage,handlers}: limit content sizes	2017-07-06 17:13:39 -07:00
tags.go	Pass through known errors	2016-04-29 23:34:24 +02:00