[release/2.8] Backport CVE-2026-33540 and CVE-2026-35172 fixes#1
Open
yuzichen12123 wants to merge 4 commits into
Open
[release/2.8] Backport CVE-2026-33540 and CVE-2026-35172 fixes#1yuzichen12123 wants to merge 4 commits into
yuzichen12123 wants to merge 4 commits into
Conversation
🤖 AI Code Review
SummaryThis PR backports two security fixes: CVE-2026-33540 (proxy realm trust-boundary) and CVE-2026-35172 (redis repo-scoped descriptor revocation). The changes introduce a Review Statistics
Critical Issues
Warnings
Positive Feedback
ℹ️ About this reviewThis review was automatically generated using the
|
bind proxy-mode bearer realms to the upstream trust boundary before sending credentials, move challenge filtering behind the auth manager, and use golang.org/x/net/publicsuffix for registrable-domain handling. (cherry picked from commit f215e51) Signed-off-by: yuzichen <1062955096@qq.com>
(cherry picked from commit 5cda728) Signed-off-by: yuzichen <1062955096@qq.com>
Signed-off-by: yuzichen <1062955096@qq.com>
yuzichen12123
force-pushed
the
alauda-release-2.8
branch
from
f60be87 to
bef74e5
Compare
Signed-off-by: yuzichen <1062955096@qq.com>
alaudabot
reviewed
Apr 22, 2026
| // Remove the repository-scoped membership and descriptor metadata in one transaction. | ||
| if _, err := conn.Do("MULTI"); err != nil { | ||
| return err | ||
| } |
There was a problem hiding this comment.
Critical (bug/connection-leak): This returns early without calling EXEC or DISCARD, leaving the Redis connection in MULTI state. The connection will be returned to the pool in a dirty state.
Suggested change
| } | |
| if _, err := conn.Do("SREM", rsrbds.repositoryBlobSetKey(rsrbds.repo), dgst); err != nil { | |
| conn.Do("DISCARD") | |
| return err | |
| } |
| } | ||
| if _, err := conn.Do("SREM", rsrbds.repositoryBlobSetKey(rsrbds.repo), dgst); err != nil { | ||
| return err | ||
| } |
There was a problem hiding this comment.
Critical (bug/connection-leak): Same issue - returns early without cleaning up the MULTI transaction state.
| } | ||
| if _, err := conn.Do("DEL", rsrbds.blobDescriptorHashKey(dgst)); err != nil { | ||
| return err | ||
| } |
There was a problem hiding this comment.
Critical (bug/connection-leak): Same issue - returns early without cleaning up the MULTI transaction state.
| // Deprecated: Use [reference.Domain] or [reference.Path]. | ||
| func SplitHostname(named reference.Named) (string, string) { | ||
| return reference.SplitHostname(named) | ||
| return reference.Domain(named), reference.Path(named) |
There was a problem hiding this comment.
Warning (refactor/behavior-change): This replaces SplitHostname with Domain + Path. These may have different semantics - please verify backward compatibility.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary\n- backport proxy realm trust-boundary fix (CVE-2026-33540)\n- backport redis repo-scoped descriptor revocation fix (CVE-2026-35172)\n- add redis regression test for repo-scoped clear behavior on v2\n\n## Notes\n- keep v2-compatible implementation and test strategy\n- do not pull v3-only test dependencies into release/2.8\n