fix: restore digest validation

Author: d3vco

lib/extractor/oci-distribution-metadata.ts

@@ -1,4 +1,4 @@
-import { parseImageReference } from "../image-reference";
+import { isValidDigest, parseImageReference } from "../image-reference";
 
 export interface OCIDistributionMetadata {
   // Must be a valid host, including port if one was used to pull the image.
@@ -44,14 +44,7 @@ export function constructOCIDisributionMetadata({
       imageTag: parsed.tag,
     };
 
-    // 255 byte limit is enforced by RFC 1035.
-    if (Buffer.byteLength(metadata.registryHost) > 255) {
-      return;
-    }
-
-    // 2048 byte limit is enforced by Snyk for platform stability.
-    // Longer strings may be valid, but nothing close to this limit has been observed by Snyk at time of writing.
-    if (Buffer.byteLength(metadata.repository) > 2048) {
+    if (!ociDistributionMetadataIsValid(metadata)) {
       return;
     }
 
@@ -60,3 +53,28 @@ export function constructOCIDisributionMetadata({
     return;
   }
 }
+
+function ociDistributionMetadataIsValid(
+  data: OCIDistributionMetadata,
+): boolean {
+  // 255 byte limit is enforced by RFC 1035.
+  if (Buffer.byteLength(data.registryHost) > 255) {
+    return false;
+  }
+
+  // 2048 byte limit is enforced by Snyk for platform stability.
+  // Longer strings may be valid, but nothing close to this limit has been observed by Snyk at time of writing.
+  if (Buffer.byteLength(data.repository) > 2048) {
+    return false;
+  }
+
+  if (!isValidDigest(data.manifestDigest)) {
+    return false;
+  }
+
+  if (data.indexDigest && !isValidDigest(data.indexDigest)) {
+    return false;
+  }
+
+  return true;
+}

lib/image-reference.ts

@@ -13,6 +13,10 @@ const imageReferenceRegex = new RegExp(imageReferencePattern);
 const imageRegistryPattern = String.raw`^((?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+|\[(?:[a-fA-F0-9:]+)\]|localhost)(?::[0-9]+)?)(?:/|@)`;
 const imageRegistryRegex = new RegExp(imageRegistryPattern);
 
+// Digest regex. Anchored to the start and end of the string.
+const digestPattern = String.raw`^[A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][a-fA-F0-9]{32,}$`;
+const digestRegex = new RegExp(digestPattern);
+
 export class ParsedImageReference {
   /** Repository path (e.g. nginx, library/nginx) */
   public readonly repository: string;
@@ -165,3 +169,13 @@ export function isValidImageReference(reference: string): boolean {
     return false;
   }
 }
+
+/**
+ * Validate a digest string.
+ *
+ * @param digest - Digest string to validate
+ * @returns true if the digest is valid, false otherwise
+ */
+export function isValidDigest(digest: string): boolean {
+  return digestRegex.test(digest);
+}