CircleCI-Public / CircleCI-Public/docker-orb

`install_dockerize` overwrite project files with `dockerize` v0.11.0

Open Beginner friendly
#215 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
31
Forks
61
PR merge metrics
No merged PRs in 30d

Description

### Orb version

3.0.1

### What happened

The `install_dockerize` command extracts the `dockerize` tarball in the current working directory (typically, the project root).

Starting with [`dockerize` v0.11.0](https://github.com/jwilder/dockerize/releases/tag/v0.11.0), the tarball includes `README.md` and `LICENSE` files in addition to the `dockerize` binary. This causes the project's own `README.md` and `LICENSE` to be silently overwritten during extraction.

```sh-session
$ curl -sL https://github.com/jwilder/dockerize/releases/download/v0.11.0/dockerize-linux-amd64-v0.11.0.tar.gz | tar tzf -
LICENSE
README.md
dockerize
```

The relevant code in `install_dockerize.sh`:

https://github.com/CircleCI-Public/docker-orb/blob/e8af393026568ffb18c5dfcdbbf756a431558801/src/scripts/install_dockerize.sh#L49-L53

This extracts all files into the current directory without any path restriction.

Previous `dockerize` releases only contained the `dockerize` binary, so this was not an issue before.

```sh-session
$ curl -sL https://github.com/jwilder/dockerize/releases/download/v0.10.0/dockerize-linux-amd64-v0.10.0.tar.gz | tar tzf -
dockerize
```

### Expected behavior

`install_dockerize` should not modify any project files.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in install_dockerize.sh at lines 49-53 and inspect how the v0.11.0 tarball is extracted in the current directory. Reproduce the command with the v0.11.0 archive, then verify that installation leaves the project's README.md and LICENSE unchanged while still installing the dockerize binary.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, shell
Domain
devops
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.