fix(security): resolve CodeQL alerts blocking the v3 release

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     name: Detect changes

internal/adapters/out/filesystem/manifest.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 	"time"
 
 	"github.com/bnema/zerowrap"
@@ -263,6 +264,9 @@ func (s *ManifestStorage) GetManifestModTime(name, reference string) (time.Time,
 
 func (s *ManifestStorage) getManifestPath(name, reference string) (string, error) {
 	// Validate name to prevent path traversal (defense in depth)
+	if strings.Contains(name, "..") || strings.Contains(reference, "..") {
+		return "", fmt.Errorf("path traversal not allowed")
+	}
 	if _, err := validation.ValidatePath(name); err != nil {
 		return "", fmt.Errorf("invalid repository name: %w", err)
 	}

internal/usecase/logs/service.go

@@ -456,11 +456,17 @@ func (s *Service) FollowContainerLogs(ctx context.Context, domain string, initia
 	return ch, nil
 }
 
+// maxTailLines bounds the ring buffer allocated by tailLines.
+const maxTailLines = 10000
+
 // tailLines reads the last N lines from a file using a ring buffer.
 func tailLines(file *os.File, n int) ([]string, error) {
 	if n <= 0 {
 		return []string{}, nil
 	}
+	if n > maxTailLines {
+		n = maxTailLines
+	}
 
 	// Seek to beginning
 	if _, err := file.Seek(0, io.SeekStart); err != nil {

internal/usecase/registry/service.go

@@ -272,6 +272,9 @@ func (s *Service) validateManifestBlobs(name string, data []byte) error {
 		if descriptor.Digest == "" {
 			continue
 		}
+		if err := validation.ValidateDigest(descriptor.Digest); err != nil {
+			return fmt.Errorf("%w: %s", domain.ErrManifestBlobUnknown, err)
+		}
 		if _, _, err := s.manifestStorage.GetManifest(name, descriptor.Digest); err != nil {
 			return fmt.Errorf("%w: %s", domain.ErrManifestBlobUnknown, descriptor.Digest)
 		}

internal/usecase/registry/service_test.go

@@ -149,6 +149,24 @@ func TestService_PutManifest_RejectsUnknownChildManifest(t *testing.T) {
 	require.ErrorIs(t, err, domain.ErrManifestBlobUnknown)
 }
 
+func TestService_PutManifest_RejectsMalformedChildDigest(t *testing.T) {
+	blobStorage := mocks.NewMockBlobStorage(t)
+	manifestStorage := mocks.NewMockManifestStorage(t)
+	svc := NewService(blobStorage, manifestStorage, nil)
+
+	manifest := &domain.Manifest{
+		Name:        "index",
+		Reference:   "latest",
+		ContentType: "application/vnd.oci.image.index.v1+json",
+		Data:        []byte(`{"schemaVersion":2,"manifests":[{"digest":"../../tags.json"}]}`),
+	}
+
+	_, err := svc.PutManifest(testContext(), manifest)
+
+	require.ErrorIs(t, err, domain.ErrManifestBlobUnknown)
+	manifestStorage.AssertNotCalled(t, "GetManifest", mock.Anything, mock.Anything)
+}
+
 func TestService_PutManifest_SHA512DigestDoesNotPublishEvent(t *testing.T) {
 	blobStorage := mocks.NewMockBlobStorage(t)
 	manifestStorage := mocks.NewMockManifestStorage(t)