Skip to content

fix(supervisor): validate HostPort digits and range instead of bare parseInt #390

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Ayush7614 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(supervisor): validate HostPort digits and range instead of bare parseInt #390

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion supervisor/src/docker.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,20 @@ function portOf(ports?: Docker.Port[] | undefined): number | undefined {
return published ?? undefined;
}

/**
* A published port from `inspect`, which Docker reports as a string.
*
* The daemon hands back `""` before a port is assigned and anything at all when it
* misbehaves, so a bare `parseInt` turns `"abc"` into a `NaN` port and `"0"` into a
* port nothing can dial. Only digits in range are a port; anything else is no port.
*/
export function parseHostPort(value: unknown): number | undefined {
if (typeof value !== "string" || !/^\d+$/.test(value)) return undefined;
const port = Number.parseInt(value, 10);
if (!Number.isSafeInteger(port) || port < 1 || port > 65535) return undefined;
return port;
}

/**
* Whether a labelled thing belongs to this deployment.
*
Expand Down Expand Up @@ -209,9 +223,10 @@ async function inspectOwned(names: ComputerNames): Promise<{
if (!ours(info.Config?.Labels)) return null;
const published =
info.NetworkSettings?.Ports?.[COMPUTER_PORT]?.[0]?.HostPort;
const port = parseHostPort(published);
return {
status: info.State?.Status ?? "unknown",
...(published ? { port: Number.parseInt(published, 10) } : {}),
...(port !== undefined ? { port } : {}),
// The resolved image, not the tag it was started from. A tag moves when the image is
// rebuilt; this is what the container is actually running.
...(info.Image ? { image: info.Image } : {}),
Expand Down