Liron Levin 05479dd564 Fix #20508 - Authz plugin enabled with large text/JSON POST payload corrupts body ...

Based on the discussion, we have changed the following:

1. Send body only if content-type is application/json (based on the
Docker official daemon REST specification, this is the provided for all
APIs that requires authorization.

2. Correctly verify that the msg body is smaller than max cap (this was
the actual bug). Fix includes UT.

3. Minor: Check content length > 0 (it was -1 for load, altough an
attacker can still modify this)

Signed-off-by: Liron Levin <liron@twistlock.com>
Upstream-commit: ca5c2abecfd12ad22b75c69e0debde7b625c2735
Component: engine

2016-02-25 08:11:55 +02:00

components/engine

Fix #20508 - Authz plugin enabled with large text/JSON POST payload corrupts body

2016-02-25 08:11:55 +02:00

S

Description

No description provided

310 MiB

Languages

Go 92%

Shell 5.5%

Dockerfile 1.1%

Go-Checksums 0.9%

Makefile 0.3%

Other 0.2%