Summary
_extract_dockerfile_instruction_sources (getter.py:355) runs context_path.glob(source) on COPY/ADD source patterns from a module's Dockerfile. Path.glob follows .. segments, so a source like ../outside matches files outside the build context. Verified: Path('ctx').glob('../outside.txt') returns the file outside ctx/.
Problem
The match is resolved and added to the asset set without a _require_within_repo check. Later, _add_copy_action calls relative_to(source_repo) on it (getter.py:510), which raises an unhandled ValueError for out-of-repo paths. cds get dies with a raw traceback instead of a GetError; violating the documented "completes safely" contract; when pointed at a source repo whose Dockerfile contains COPY ../....
Suggested fix
- Reject source patterns containing
.. segments (or validate each glob match with _require_within_repo).
- Wrap the
relative_to in _add_copy_action so a stray path surfaces as GetError, not a traceback.
Files involved
- cli/getter.py (lines 343-360, 503-524)
Summary
_extract_dockerfile_instruction_sources(getter.py:355) runscontext_path.glob(source)on COPY/ADD source patterns from a module's Dockerfile.Path.globfollows..segments, so a source like../outsidematches files outside the build context. Verified:Path('ctx').glob('../outside.txt')returns the file outsidectx/.Problem
The match is resolved and added to the asset set without a
_require_within_repocheck. Later,_add_copy_actioncallsrelative_to(source_repo)on it (getter.py:510), which raises an unhandledValueErrorfor out-of-repo paths.cds getdies with a raw traceback instead of aGetError; violating the documented "completes safely" contract; when pointed at a source repo whose Dockerfile containsCOPY ../....Suggested fix
..segments (or validate each glob match with_require_within_repo).relative_toin_add_copy_actionso a stray path surfaces asGetError, not a traceback.Files involved