at-container-registry/scanner/internal/scan/worker_skip_test.go

package scan

import (
	"strings"
	"testing"

	scanner "atcr.io/scanner"
)

// hexDigest builds a well-formed sha256 digest from a one-character seed.
// skipReason validates every digest it will use, so a placeholder like
// "sha256:config" is now itself a skip and would mask what these cases test.
func hexDigest(seed rune) string {
	return "sha256:" + strings.Repeat(string(seed), scanner.HexLen)
}

// TestSkipReason covers the artifact shapes the scanner must refuse before it
// spends a download on them. The attestation case is the one that reached
// production: an in-toto SLSA provenance manifest carries an ordinary image
// config, so the config media type check alone waved it through and Syft was
// handed an OCI layout with no layers in it.
func TestSkipReason(t *testing.T) {
	tests := []struct {
		name       string
		configType string
		layerTypes []string
		wantSkip   bool
	}{
		{
			name:       "container image",
			configType: "application/vnd.oci.image.config.v1+json",
			layerTypes: []string{"application/vnd.oci.image.layer.v1.tar+gzip"},
		},
		{
			name:       "docker image",
			configType: "application/vnd.docker.container.image.v1+json",
			layerTypes: []string{"application/vnd.docker.image.rootfs.diff.tar.gzip"},
		},
		{
			name:       "layer media type absent",
			configType: "application/vnd.oci.image.config.v1+json",
			layerTypes: []string{""},
		},
		{
			name:       "helm chart",
			configType: "application/vnd.cncf.helm.config.v1+json",
			layerTypes: []string{"application/vnd.cncf.helm.chart.content.v1.tar+gzip"},
			wantSkip:   true,
		},
		{
			name:       "in-toto attestation with an image config",
			configType: "application/vnd.oci.image.config.v1+json",
			layerTypes: []string{"application/vnd.in-toto+json"},
			wantSkip:   true,
		},
		{
			name:       "dsse envelope layer",
			configType: "application/vnd.oci.image.config.v1+json",
			layerTypes: []string{"application/vnd.dsse.envelope.v1+json"},
			wantSkip:   true,
		},
		{
			name:       "mixed layers keep the scannable one",
			configType: "application/vnd.oci.image.config.v1+json",
			layerTypes: []string{"application/vnd.in-toto+json", "application/vnd.oci.image.layer.v1.tar"},
		},
		{
			name:       "no layers at all is left to the pipeline",
			configType: "application/vnd.oci.image.config.v1+json",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			job := &scanner.ScanJob{
				Config: scanner.BlobDescriptor{MediaType: tt.configType, Digest: hexDigest('c')},
			}
			for i, mt := range tt.layerTypes {
				job.Layers = append(job.Layers, scanner.BlobDescriptor{
					MediaType: mt,
					Digest:    hexDigest(rune('a' + i)),
				})
			}

			reason := skipReason(job)
			if got := reason != ""; got != tt.wantSkip {
				t.Errorf("skipReason = %q, wantSkip=%v", reason, tt.wantSkip)
			}
		})
	}
}

// TestSkipReasonRejectsMalformedDigests pins the other half of skipReason: a
// digest that is not a digest is a permanent property of the record, so the
// job is refused here rather than failing later as a retryable error.
//
// A malformed digest on a layer the layout would drop anyway is not a reason
// to refuse the image, and the last case pins that: the check walks exactly the
// blobs referencedBlobs will fetch.
func TestSkipReasonRejectsMalformedDigests(t *testing.T) {
	const layerType = "application/vnd.oci.image.layer.v1.tar+gzip"
	const configType = "application/vnd.oci.image.config.v1+json"

	tests := []struct {
		name     string
		job      *scanner.ScanJob
		wantSkip bool
	}{
		{
			name: "path traversal in a layer digest",
			job: &scanner.ScanJob{
				Config: scanner.BlobDescriptor{MediaType: configType, Digest: hexDigest('c')},
				Layers: []scanner.BlobDescriptor{{MediaType: layerType, Digest: "sha256:../../../escaped"}},
			},
			wantSkip: true,
		},
		{
			name: "path traversal in the config digest",
			job: &scanner.ScanJob{
				Config: scanner.BlobDescriptor{MediaType: configType, Digest: "sha256:../../../escaped"},
				Layers: []scanner.BlobDescriptor{{MediaType: layerType, Digest: hexDigest('a')}},
			},
			wantSkip: true,
		},
		{
			name: "no algorithm prefix",
			job: &scanner.ScanJob{
				Config: scanner.BlobDescriptor{MediaType: configType, Digest: hexDigest('c')},
				Layers: []scanner.BlobDescriptor{{MediaType: layerType, Digest: strings.Repeat("ef", 32)}},
			},
			wantSkip: true,
		},
		{
			name: "unsupported algorithm",
			job: &scanner.ScanJob{
				Config: scanner.BlobDescriptor{MediaType: configType, Digest: hexDigest('c')},
				Layers: []scanner.BlobDescriptor{{MediaType: layerType, Digest: "sha512:" + strings.Repeat("cd", 64)}},
			},
			wantSkip: true,
		},
		{
			name: "an empty layer digest is dropped, not refused",
			job: &scanner.ScanJob{
				Config: scanner.BlobDescriptor{MediaType: configType, Digest: hexDigest('c')},
				Layers: []scanner.BlobDescriptor{
					{MediaType: layerType, Digest: ""},
					{MediaType: layerType, Digest: hexDigest('a')},
				},
			},
		},
		{
			name: "a dropped non-tar layer's digest is not checked",
			job: &scanner.ScanJob{
				Config: scanner.BlobDescriptor{MediaType: configType, Digest: hexDigest('c')},
				Layers: []scanner.BlobDescriptor{
					{MediaType: "application/vnd.oci.image.layer.v1.zstd+odd", Digest: "not a digest"},
					{MediaType: layerType, Digest: hexDigest('a')},
				},
			},
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			reason := skipReason(tt.job)
			if got := reason != ""; got != tt.wantSkip {
				t.Errorf("skipReason = %q, wantSkip=%v", reason, tt.wantSkip)
			}
		})
	}
}