From 800cb1f50f71e913404fb55c93452b6d78b30cdb Mon Sep 17 00:00:00 2001 From: orbisai0security Date: Mon, 20 Apr 2026 03:52:48 +0000 Subject: [PATCH] fix: V-001 security vulnerability Automated security fix generated by Orbis Security AI --- .../docker-credential-helpers/client/client.go | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/vendor/github.com/docker/docker-credential-helpers/client/client.go b/vendor/github.com/docker/docker-credential-helpers/client/client.go index 7ca5ab72..761ce5c3 100644 --- a/vendor/github.com/docker/docker-credential-helpers/client/client.go +++ b/vendor/github.com/docker/docker-credential-helpers/client/client.go @@ -9,6 +9,16 @@ import ( "github.com/docker/docker-credential-helpers/credentials" ) +// validateServerURL checks that the serverURL does not contain characters that +// could be used to inject additional protocol messages into the credential helper +// stdin stream (e.g. newline characters used in line-delimited protocols). +func validateServerURL(serverURL string) error { + if strings.ContainsAny(serverURL, "\n\r") { + return fmt.Errorf("invalid serverURL: must not contain newline characters") + } + return nil +} + // isValidCredsMessage checks if 'msg' contains invalid credentials error message. // It returns whether the logs are free of invalid credentials errors and the error if it isn't. // error values can be errCredentialsMissingServerURL or errCredentialsMissingUsername. @@ -45,6 +55,9 @@ func Store(program ProgramFunc, creds *credentials.Credentials) error { // Get executes an external program to get the credentials from a native store. func Get(program ProgramFunc, serverURL string) (*credentials.Credentials, error) { + if err := validateServerURL(serverURL); err != nil { + return nil, err + } cmd := program(credentials.ActionGet) cmd.Input(strings.NewReader(serverURL)) @@ -74,6 +87,9 @@ func Get(program ProgramFunc, serverURL string) (*credentials.Credentials, error // Erase executes a program to remove the server credentials from the native store. func Erase(program ProgramFunc, serverURL string) error { + if err := validateServerURL(serverURL); err != nil { + return err + } cmd := program(credentials.ActionErase) cmd.Input(strings.NewReader(serverURL)) out, err := cmd.Output()