crashappsec / crashappsec/chalk

Chalk extract doesn't differentiate between docker image and file

Open
#655 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Nim
Stars
436
Forks
25
PR merge metrics
No merged PRs in 30d

Description

## Description

If you have a path that happens to be in the same format as a Docker image chalk will select the file.

```
$ ~/chalk extract localhost:5000/wordsmith:latest
warn: /home/admin/wordsmith/api/localhost:5000/wordsmith:latest: Artifact is unchalked
info: /home/admin/.local/chalk/chalk.log: Open (sink conf='default_out')
info: Full chalk report appended to: ~/.local/chalk/chalk.log
... omitted
```

```
admin@ubuntu:~/wordsmith/api$ ls
Dockerfile localhost:5000 pom.xml src
admin@ubuntu:~/wordsmith/api$ ls localhost\:5000/
wordsmith:latest
```

Perhaps better to have a flag that signals that this is a docker image? Or a docker:// prefix to show that you are intended this to be a docker image?

## Impact

Dunno.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the `chalk extract` command and reproduce the collision using a path named like `localhost:5000/wordsmith:latest`, as shown in the issue. Determine how the CLI distinguishes Docker images from filesystem paths, then confirm the chosen interface handles both cases without selecting the wrong artifact.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, nim
Domain
cli, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.