Skip to content

Validate function tag literals before execution #4503

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AkashKumar7902 wants to merge 3 commits into
base: main
Choose a base branch
from
+27 −2
Open

Validate function tag literals before execution #4503

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a260134
Validate function tag literals before execution
AkashKumar7902 Apr 24, 2026
b47453b
Clarify image tag validation error
AkashKumar7902 Apr 24, 2026
9782c09
Address review: use distribution/reference TagRegexp, simplify contro…
AkashKumar7902 Apr 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ require (
github.com/Masterminds/semver/v3 v3.4.0
github.com/bytecodealliance/wasmtime-go v1.0.0
github.com/cpuguy83/go-md2man/v2 v2.0.7
github.com/distribution/reference v0.6.0
github.com/go-errors/errors v1.5.1
github.com/google/go-cmp v0.7.0
github.com/google/go-containerregistry v0.20.6
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
github.com/docker/cli v29.2.0+incompatible h1:9oBd9+YM7rxjZLfyMGxjraKBKE4/nVyvVfN4qNl9XRM=
github.com/docker/cli v29.2.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
Expand Down Expand Up @@ -127,8 +129,6 @@ github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG
github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
github.com/moby/spdystream v0.5.1 h1:9sNYeYZUcci9R6/w7KDaFWEWeV4LStVG78Mpyq/Zm/Y=
github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
Expand Down
12 changes: 12 additions & 0 deletions pkg/fn/runtime/tag_resolution.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,10 +21,13 @@ import (
"strings"

"github.com/Masterminds/semver/v3"
"github.com/distribution/reference"
regclientref "github.com/regclient/regclient/types/ref"
"k8s.io/klog/v2"
)

const imageTagError = "must start with an alphanumeric character or underscore, followed by at most 127 alphanumeric characters, underscores, periods, or dashes"

// TagLister is an interface for listing tags for/from a function runtime/runner
type TagLister interface {
Name() string
Expand Down Expand Up @@ -89,6 +92,15 @@ func (tr *TagResolver) ResolveFunctionImage(ctx context.Context, image, tag stri
tag, versionErr, constraintErr)
}

return imageWithLiteralTag(ref, tag)
}

func imageWithLiteralTag(ref regclientref.Ref, tag string) (string, error) {
// reference.TagRegexp is the canonical OCI/Docker tag pattern but is
// unanchored, so require a full-string match to reject embedded matches.
if match := reference.TagRegexp.FindString(tag); match != tag {
return "", fmt.Errorf("`function.tag` %q must be a valid image tag: %s", tag, imageTagError)
}
ref.Tag = tag
return ref.CommonName(), nil
}
Expand Down
12 changes: 12 additions & 0 deletions pkg/fn/runtime/tag_resolution_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,12 @@ func TestResolveFunctionImage(t *testing.T) {
repoTags: tagSet,
expectedTag: "v0.3.1",
},
"exact semver tag with invalid image tag syntax": {
functionImage: image,
functionTag: "v0.3.1+build",
repoTags: tagSet,
expectedErr: "`function.tag` \"v0.3.1+build\" must be a valid image tag",
},
"no listing with exact semver tag": {
functionImage: image,
functionTag: "v0.3.1",
Expand All @@ -164,6 +170,12 @@ func TestResolveFunctionImage(t *testing.T) {
repoErr: "test",
expectedTag: "master-git-38f885f",
},
"invalid non-semver tag": {
functionImage: image,
functionTag: ">>0.1",
repoTags: tagSet,
expectedErr: "`function.tag` \">>0.1\" must be a valid image tag",
},
"list failure": {
functionImage: image,
functionTag: "~0.1",
Expand Down