[draft] add npx wrangler containers registry put command #10605
Conversation
🦋 Changeset detectedLatest commit: 8a5ab65 The changes in this PR will be included in the next version bump. This PR includes changesets to release 4 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
create-cloudflare
@cloudflare/kv-asset-handler
miniflare
@cloudflare/pages-shared
@cloudflare/unenv-preset
@cloudflare/vite-plugin
@cloudflare/vitest-pool-workers
@cloudflare/workers-editor-shared
wrangler
commit: |
31e3a27 to
66fc3ae
Compare
66fc3ae to
8a5ab65
Compare
| { | ||
| type: "cloudflare", | ||
| pattern: new RegExp( | ||
| `^${getCloudflareContainerRegistry().replace(/\./g, "\\.")}$` |
Check failure
Code scanning / CodeQL
Incomplete string escaping or encoding High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 13 hours ago
The problem should be fixed by robustly escaping all characters in the registry string that have special meaning in regular expressions before interpolation into a regex pattern. JavaScript does not have a built-in escapeRegExp function, but its standard implementation is well understood. The best fix is to introduce a utility—either implement a local escapeRegExp function, or (preferably) use a library like lodash.escapeRegExp. Since editing outside the given file is not allowed and no such utility is imported, we should define a local escapeRegExp within this file, and use it in the RegExp construction in line 169. This avoids partial/manual escaping and future-proofs the code. This function should escape backslashes before other meta-characters to avoid double-escape errors. Place the helper near the usage (e.g., just above getRegistryType).
| @@ -166,7 +166,7 @@ | ||
| { | ||
| type: "cloudflare", | ||
| pattern: new RegExp( | ||
| `^${getCloudflareContainerRegistry().replace(/\./g, "\\.")}$` | ||
| `^${escapeRegExp(getCloudflareContainerRegistry())}$` | ||
| ), | ||
| name: "Cloudflare Containers Managed Registry", | ||
| }, | ||
| @@ -189,6 +189,11 @@ | ||
| return match; | ||
| }; | ||
|
|
||
| // Escapes special characters for use in a RegExp constructor | ||
| function escapeRegExp(str: string): string { | ||
| return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); | ||
| } | ||
|
|
||
| interface RegistryPattern { | ||
| type: "aws-ecr" | "cloudflare"; | ||
| pattern: RegExp; |
| const isContainerManagedRegistry = container.image.startsWith( | ||
| "registry.cloudflare.com" | ||
| ); |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 13 hours ago
To securely check whether container.image refers to an image from the managed registry (registry.cloudflare.com), we must parse the registry host portion from the URI and compare it to a whitelist of allowed hosts. This means:
- Parse the host portion of the image URI using a robust image parsing method.
- Check for explicit equality to
"registry.cloudflare.com", not simple substring or prefix matches. - If there are valid subdomains to allow, include those in the whitelist, but typically only the exact root registry is allowed for managed images.
- The edit is in
packages/wrangler/src/containers/config.ts, on line 186 where the prefix check occurs. - We'll need a reliable way to extract the host from Docker image references. Since Docker image references have a non-URL format, the registry host is typically everything before the first
/, defaulting to Docker Hub if not present. We can safely split the string at the/and check explicitly that the host matches. - If an external library (such as
docker-registry-hostor similar) is not available, implement the registry host extraction inline in a well-known, robust manner. - Change the check at line 186 to compare the extracted registry host to
"registry.cloudflare.com".
| @@ -183,9 +183,11 @@ | ||
| } | ||
| ); | ||
| } | ||
| const isContainerManagedRegistry = container.image.startsWith( | ||
| "registry.cloudflare.com" | ||
| ); | ||
| // Extract registry host (everything before first '/'), then check for exact match | ||
| const imageRegistryHost = container.image.includes("/") | ||
| ? container.image.split("/")[0] | ||
| : ""; | ||
| const isContainerManagedRegistry = imageRegistryHost === "registry.cloudflare.com"; | ||
| normalizedContainers.push({ | ||
| ...shared, | ||
| ...instanceTypeOrLimits, |
wip
CC-5835
this is to support configuring credentials for external (non cloudflare) registries.