From 5492ac01072f4087097d45418dea1fc545cf6b9e Mon Sep 17 00:00:00 2001
From: xu yang <xyang@ciq.com>
Date: Thu, 12 Sep 2024 23:48:53 +0000
Subject: [PATCH] Return an error during `wwctl container import` if archive
 filename contains a colon

Signed-off-by: xu yang <xyang@ciq.com>
---
 CHANGELOG.md                    |  6 +++
 internal/pkg/oci/puller.go      |  6 ++-
 internal/pkg/oci/puller_test.go | 70 +++++++++++++++++++++++++++++++++
 3 files changed, 81 insertions(+), 1 deletion(-)
 create mode 100644 internal/pkg/oci/puller_test.go

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 408f3383..1a28e1b7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -40,6 +40,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Replace slice in templates with sprig substr. #1093
 - Fix an invalid format issue for the GitHub nightly build action. #1258
 
+## v4.5.8, unreleased
+
+### Fixed
+
+- Return an error during `wwctl container import` if archive filename includes a colon. #1371
+
 ## v4.5.7, 2024-09-11
 
 ### Added
diff --git a/internal/pkg/oci/puller.go b/internal/pkg/oci/puller.go
index fda36036..e7b194b3 100644
--- a/internal/pkg/oci/puller.go
+++ b/internal/pkg/oci/puller.go
@@ -83,7 +83,11 @@ func getReference(uri string) (types.ImageReference, error) {
 	case "docker-daemon":
 		return daemon.ParseReference(strings.TrimPrefix(s[1], "//"))
 	case "file":
-		return dockerarchive.ParseReference(strings.TrimPrefix(s[1], "/"))
+		reference := strings.TrimPrefix(s[1], "//")
+		if strings.Contains(reference, ":") {
+			return nil, fmt.Errorf("%s should not contain a colon", reference)
+		}
+		return dockerarchive.ParseReference(reference)
 	default:
 		return nil, fmt.Errorf("unknown uri scheme: %q", uri)
 	}
diff --git a/internal/pkg/oci/puller_test.go b/internal/pkg/oci/puller_test.go
new file mode 100644
index 00000000..44f18b81
--- /dev/null
+++ b/internal/pkg/oci/puller_test.go
@@ -0,0 +1,70 @@
+package oci
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetReference(t *testing.T) {
+	temp, err := os.MkdirTemp(os.TempDir(), "ww-archive-*")
+	assert.NoError(t, err)
+	defer os.RemoveAll(temp)
+
+	tests := []struct {
+		name string
+		uri  string
+		err  error
+	}{
+		{
+			name: "file archive ok case",
+			uri:  "test.tar",
+			err:  nil,
+		},
+		{
+			name: "file archive ko case, because having colon in file name",
+			uri:  "test:latest.tar",
+			err:  fmt.Errorf("/test:latest.tar should not contain a colon"),
+		},
+		{
+			name: "file archive ko case, because having colon in path name",
+			uri:  "/test:/test.tar",
+			err:  fmt.Errorf("/test:/test.tar should not contain a colon"),
+		},
+		{
+			name: "docker ok case",
+			uri:  "docker://test:latest",
+			err:  nil,
+		},
+		{
+			name: "docker daemon ok case",
+			uri:  "docker-daemon://test:latest",
+			err:  nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Logf("running test: %s", tt.name)
+		if !strings.HasPrefix(tt.uri, "docker") && !strings.HasPrefix(tt.uri, "docker-daemon") {
+			tt.uri = filepath.Join(temp, tt.uri)
+			parent := filepath.Dir(tt.uri)
+			err := os.MkdirAll(parent, 0o755)
+			assert.NoError(t, err)
+			f, err := os.Create(tt.uri)
+			assert.NoError(t, err)
+			assert.NoError(t, f.Close())
+		}
+
+		_, err := getReference(tt.uri)
+		if tt.err == nil {
+			assert.NoError(t, err)
+		} else {
+			assert.ErrorContains(t, err, tt.err.Error())
+		}
+	}
+
+}