@cdxgen/cdxgen 13.2.0 → 13.3.0

package/lib/managers/docker.js

@@ -6,7 +6,14 @@ import {
   readFileSync,
 } from "node:fs";
 import { platform as _platform, userInfo as _userInfo, homedir } from "node:os";
-import { basename, join, resolve, win32 } from "node:path";
+import {
+  basename,
+  isAbsolute,
+  join,
+  relative,
+  resolve,
+  win32,
+} from "node:path";
 import process from "node:process";
 import stream from "node:stream/promises";
 import { URL } from "node:url";
@@ -293,6 +300,34 @@ let isWinLocalTLS = false;
 let isNerdctl;
 let isColima;
 
+/**
+ * WSL Containers CLI (`wslc`), generally available with WSL 3.x. wslc accepts
+ * the exact docker CLI invocations cdxgen makes on Windows (`images
+ * --format=json`, `pull`, `inspect`, `save -o`), so it serves as a drop-in
+ * container CLI on Windows hosts that have WSL but no Docker installation.
+ *
+ * @see https://learn.microsoft.com/en-us/windows/wsl/wsl-container
+ */
+const WSLC_CLI = "wslc";
+let dockerCliInstalled;
+let wslcInstalled;
+// wslc reports container session startup failures (missing Virtual Machine
+// Platform feature, no nested virtualization when Windows itself is a VM)
+// with these markers on stderr.
+const WSLC_SESSION_FAILURE_RE =
+  /HCS_E_HYPERV_NOT_INSTALLED|Virtual Machine Platform|WSL2 is unable to start/i;
+const WSLC_SESSION_FAILURE_HINT =
+  "The wslc container session could not start. Ensure the 'Virtual Machine Platform' optional component is enabled by running 'wsl --install --no-distribution' with a subsequent reboot, and that virtualization is enabled in the firmware settings. Nested virtualization is required when Windows itself runs inside a VM.";
+const WSLC_ALTERNATIVE_HINT =
+  "wslc (WSL Containers) is installed on this host. Set the environment variable DOCKER_CMD=wslc to pull and export Linux images through WSL, for example when Docker Desktop is not running or is switched to Windows containers.";
+// Container spec files (compose, Kubernetes manifests) make cdxgen export one
+// image after another in the same process, and every image fails the same way
+// on a host with a broken container setup. Print each hint and log the CLI
+// selection only once per process.
+let wslcSessionFailureHintShown = false;
+let wslcAlternativeHintShown = false;
+let wslcSelectionRecorded = false;
+
 if (
   !readEnvironmentVariable("DOCKER_HOST") &&
   (readEnvironmentVariable("CONTAINERD_ADDRESS") ||
@@ -898,6 +933,154 @@ export const makeRequest = async (path, method, forRegistry) => {
   return await client.request(path, opts);
 };
 
+const IMAGE_TAG_RE = /^[\w][\w.-]{0,127}$/;
+const IMAGE_DIGEST_ALGO_RE = /^[a-z0-9]+(?:[.+_-][a-z0-9]+)*$/;
+const IMAGE_DIGEST_HEX_RE = /^[a-f0-9]{32,}$/;
+const IMAGE_COMPONENT_RE = /^[a-z0-9]+(?:[._-]+[a-z0-9]+)*$/;
+const IMAGE_HOST_PORT_RE = /^\d{1,5}$/;
+// A single label with a bounded quantifier and no alternation: checking hosts
+// label by label keeps the cost linear on hostile inputs, which the equivalent
+// whole-host pattern cannot promise (its nested quantifiers backtrack
+// exponentially on strings such as "0.0" followed by many repetitions of "0").
+const IMAGE_HOST_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+
+/**
+ * Validate the registry host of an image reference: a dotted name, `localhost`,
+ * or a bare name with a numeric port, each label 1-63 characters of letters,
+ * digits and inner hyphens.
+ *
+ * @param {string} host Host component without the trailing slash.
+ * @returns {boolean} true when the host is well-formed.
+ */
+const isValidImageHost = (host) => {
+  let name = host;
+  let hasPort = false;
+  const colonIndex = name.lastIndexOf(":");
+  if (colonIndex !== -1) {
+    const port = name.slice(colonIndex + 1);
+    if (!IMAGE_HOST_PORT_RE.test(port)) {
+      return false;
+    }
+    name = name.slice(0, colonIndex);
+    hasPort = true;
+  }
+  if (name === "localhost") {
+    return true;
+  }
+  if (!name.length || name.length > 253) {
+    return false;
+  }
+  const labels = name.split(".");
+  if (labels.length < 2 && !hasPort) {
+    return false;
+  }
+  return labels.every((label) => IMAGE_HOST_LABEL_RE.test(label));
+};
+
+/**
+ * Decide whether a CLI path argument is a container image reference in the
+ * styles the container pipeline documents: name, name:tag, namespace/name,
+ * registry/namespace/name:tag, registry:port/..., and any of those with a
+ * @digest. Everything that smells like a filesystem path, a URL or a CLI
+ * option never matches, so strings such as "c:\Users", "c:/tmp" or
+ * "file:///etc" can never reach the container clients: backslashes and
+ * schemes are rejected outright, and a drive-letter prefix fails because a
+ * lone letter is neither a dotted host nor a host:port, and a tag may not
+ * begin with the "/" that follows the colon in "c:/tmp".
+ *
+ * The check mirrors how the distribution reference grammar detects a registry
+ * host: the first component counts as a host only when it carries a dot, a
+ * numeric port, or is exactly localhost. Each piece is validated by a linear
+ * regex or plain string splitting, and the input is length-capped, so hostile
+ * inputs cannot backtrack expensively.
+ *
+ * @param {string} fullImageName Candidate image reference
+ * @returns {boolean} true when the string is a plausible image reference
+ */
+export const isImageReference = (fullImageName) => {
+  if (typeof fullImageName !== "string") {
+    return false;
+  }
+  const ref = fullImageName.trim().toLowerCase();
+  if (!ref.length || ref.length > 1024) {
+    return false;
+  }
+  if (
+    ref.includes("\\") ||
+    ref.includes("://") ||
+    ref.startsWith("/") ||
+    ref.startsWith("./") ||
+    ref.startsWith("../") ||
+    ref.startsWith("-") ||
+    ref.includes(" ") ||
+    /^[a-z]:/.test(ref)
+  ) {
+    return false;
+  }
+  let remainder = ref;
+  const atIndex = remainder.lastIndexOf("@");
+  if (atIndex !== -1) {
+    const digest = remainder.slice(atIndex + 1);
+    remainder = remainder.slice(0, atIndex);
+    if (remainder.includes("@") || !remainder.length) {
+      return false;
+    }
+    const digestColonIndex = digest.indexOf(":");
+    if (
+      digestColonIndex <= 0 ||
+      digestColonIndex === digest.length - 1 ||
+      !IMAGE_DIGEST_ALGO_RE.test(digest.slice(0, digestColonIndex)) ||
+      !IMAGE_DIGEST_HEX_RE.test(digest.slice(digestColonIndex + 1))
+    ) {
+      return false;
+    }
+  }
+  const slashIndex = remainder.lastIndexOf("/");
+  const colonIndex = remainder.lastIndexOf(":");
+  if (colonIndex > slashIndex) {
+    const tag = remainder.slice(colonIndex + 1);
+    remainder = remainder.slice(0, colonIndex);
+    if (!IMAGE_TAG_RE.test(tag)) {
+      return false;
+    }
+  }
+  if (!remainder.length) {
+    return false;
+  }
+  const components = remainder.split("/");
+  if (components.length > 1) {
+    const host = components[0];
+    const looksLikeHost =
+      host.includes(".") || host.includes(":") || host === "localhost";
+    if (looksLikeHost) {
+      if (!isValidImageHost(host)) {
+        return false;
+      }
+      components.shift();
+    }
+  }
+  return components.every(
+    (component) =>
+      component.length > 0 &&
+      component.length <= 255 &&
+      IMAGE_COMPONENT_RE.test(component),
+  );
+};
+
+/**
+ * Whether a string can be handed to the container CLI or the daemon API as an
+ * image reference. The exact string is checked, not a trimmed copy, so what
+ * reaches `pull`, `save` or `inspect` is a well-formed reference and never an
+ * option (such as `-o file`), a path or a URL.
+ *
+ * @param {string} fullImageName Image reference as received
+ * @returns {boolean} true when the string is safe to use as an image argument
+ */
+const isSafeImageReference = (fullImageName) =>
+  typeof fullImageName === "string" &&
+  fullImageName === fullImageName.trim() &&
+  isImageReference(fullImageName);
+
 /**
  * Parse image name
  *
@@ -983,19 +1166,129 @@ export const parseImageName = (fullImageName) => {
   return nameObj;
 };
 
+/**
+ * Detect whether the docker CLI binary is installed. `--version` runs without
+ * a daemon, so the probe is safe on hosts where Docker is installed but not
+ * running. The result is cached for the lifetime of the process.
+ *
+ * @returns {boolean} true when the docker CLI can be invoked
+ */
+const isDockerCliInstalled = () => {
+  if (dockerCliInstalled === undefined) {
+    const result = safeSpawnSync("docker", ["--version"]);
+    dockerCliInstalled = !result.error && result.status === 0;
+  }
+  return dockerCliInstalled;
+};
+
+/**
+ * Detect whether the WSL Containers CLI (`wslc`) is installed. `wslc version`
+ * is answered by the CLI itself without starting a WSL container session, so
+ * it succeeds even on hosts where nested virtualization is unavailable.
+ * The result is cached for the lifetime of the process.
+ *
+ * @returns {boolean} true when the wslc CLI can be invoked
+ */
+const isWslcInstalled = () => {
+  if (wslcInstalled === undefined) {
+    const result = safeSpawnSync(WSLC_CLI, ["version"]);
+    wslcInstalled = !result.error && result.status === 0;
+  }
+  return wslcInstalled;
+};
+
+/**
+ * Recognise wslc failures caused by the WSL container session being unable to
+ * start, as opposed to image-specific errors such as an unknown repository.
+ *
+ * @param {string|Buffer} [stderr] wslc command output to inspect
+ * @returns {boolean} true when the output points to a session startup failure
+ */
+const isWslcSessionFailure = (stderr) =>
+  !!stderr && WSLC_SESSION_FAILURE_RE.test(Buffer.from(stderr).toString());
+
+/**
+ * Recognise the wslc CLI however it is named, since `DOCKER_CMD` may hold
+ * `wslc`, `wslc.exe`, or a full path such as `C:\Program Files\WSL\wslc.exe`.
+ *
+ * @param {string} [cmd] Container CLI command
+ * @returns {boolean} true when the command invokes wslc
+ */
+const isWslcCmd = (cmd) => {
+  const cmdName = win32.basename(`${cmd || ""}`).toLowerCase();
+  return cmdName === WSLC_CLI || cmdName === `${WSLC_CLI}.exe`;
+};
+
+/**
+ * Print the wslc session-failure hint once per process. Every wslc invocation
+ * fails the same way when the WSL container session cannot start, so repeating
+ * the hint for each image would only add noise.
+ */
+const printWslcSessionFailureHint = () => {
+  if (!wslcSessionFailureHintShown) {
+    wslcSessionFailureHintShown = true;
+    console.log(WSLC_SESSION_FAILURE_HINT);
+  }
+};
+
+/**
+ * Point at wslc when the auto-selected docker CLI could not provide an image on
+ * a Windows host that also has wslc. cdxgen never switches to wslc on its own
+ * here: wslc keeps its own image store, so a silent switch could scan a
+ * registry image instead of a locally built image with the same name.
+ *
+ * @param {string} dockerCmd Container CLI that failed
+ */
+const suggestWslcAlternative = (dockerCmd) => {
+  if (
+    wslcAlternativeHintShown ||
+    !isWin ||
+    dockerCmd !== "docker" ||
+    readEnvironmentVariable("DOCKER_CMD")?.trim() ||
+    !isWslcInstalled()
+  ) {
+    return;
+  }
+  wslcAlternativeHintShown = true;
+  console.log(WSLC_ALTERNATIVE_HINT);
+};
+
 /**
  * Prefer cli on windows, nerdctl on mac, or when using tcp/ssh based host.
+ * On Windows, fall back to wslc (WSL Containers) when the docker CLI is not
+ * installed, so OCI image scans work on hosts that only have WSL.
  *
- * @returns boolean true if we should use the cli. false otherwise
+ * @returns {string} Container CLI command to invoke
  */
-const getContainerCliCmd = () => {
-  if (readEnvironmentVariable("DOCKER_CMD")?.trim()) {
-    return readEnvironmentVariable("DOCKER_CMD").trim();
+export const getContainerCliCmd = () => {
+  const configuredCli = readEnvironmentVariable("DOCKER_CMD")?.trim();
+  if (configuredCli) {
+    return configuredCli;
   }
   detectRancherDesktop() || detectColima();
   if (isNerdctl) {
     return "nerdctl";
   }
+  if (isWin && !isDockerCliInstalled() && isWslcInstalled()) {
+    if (!wslcSelectionRecorded) {
+      wslcSelectionRecorded = true;
+      recordDecisionActivity(`container-cli:${WSLC_CLI}`, {
+        metadata: {
+          decisionType: "container-cli-selection",
+          evaluatedClis: ["docker:not-installed", `${WSLC_CLI}:installed`],
+          selectedCli: WSLC_CLI,
+        },
+        reason:
+          "Selected wslc (WSL Containers) for image operations because the docker CLI is not installed.",
+      });
+      if (DEBUG_MODE) {
+        console.log(
+          "Using wslc (WSL Containers) as the container CLI since docker was not found.",
+        );
+      }
+    }
+    return WSLC_CLI;
+  }
   return "docker";
 };
 
@@ -1019,6 +1312,10 @@ const needsCliFallback = () => {
  * Method to get image to the local registry by pulling from the remote if required
  */
 export const getImage = async (fullImageName) => {
+  if (!isSafeImageReference(fullImageName)) {
+    console.log(`${fullImageName} is not a valid container image reference.`);
+    return undefined;
+  }
   let localData;
   let pullData;
   const { registry, repo, tag, digest } = parseImageName(fullImageName);
@@ -1036,8 +1333,9 @@ export const getImage = async (fullImageName) => {
     );
     return undefined;
   }
+  let dockerCmd;
   if (needsCliFallback()) {
-    const dockerCmd = getContainerCliCmd();
+    dockerCmd = getContainerCliCmd();
     let needsPull = true;
     // Let's check the local cache first
     let result = safeSpawnSync(dockerCmd, ["images", "--format=json"]);
@@ -1057,7 +1355,16 @@ export const getImage = async (fullImageName) => {
     if (needsPull) {
       result = safeSpawnSync(dockerCmd, ["pull", fullImageName]);
       if (result.status !== 0 || result.error) {
-        if (result.stderr?.includes("docker daemon is not running")) {
+        if (isWslcCmd(dockerCmd)) {
+          // wslc runs Docker Engine inside its own VM, so its errors may
+          // mention a docker daemon; the Docker Desktop and DOCKER_CMD hints
+          // below do not apply. Show wslc's own error instead.
+          if (isWslcSessionFailure(result.stderr)) {
+            printWslcSessionFailureHint();
+          } else if (result.stderr) {
+            console.log(result.stderr);
+          }
+        } else if (result.stderr?.includes("docker daemon is not running")) {
           console.log(
             "Ensure Docker for Desktop is running as an administrator with 'Exposing daemon on TCP without TLS' setting turned on.",
           );
@@ -1075,6 +1382,7 @@ export const getImage = async (fullImageName) => {
       if (result.stderr) {
         console.log(result.stderr);
       }
+      suggestWslcAlternative(dockerCmd);
       // Continue with the daemon client when the CLI fallback is unavailable
       // or unable to inspect the image.
     } else {
@@ -1091,6 +1399,13 @@ export const getImage = async (fullImageName) => {
         // continue regardless of error
       }
     }
+    // wslc has no daemon API, and exportImage saves the image through wslc
+    // again. A Docker daemon could only offer an image that wslc cannot
+    // export, and probing it warns about Docker Desktop on hosts without it.
+    if (isWslcCmd(dockerCmd)) {
+      reportImagePullFailure(fullImageName, dockerCmd);
+      return undefined;
+    }
   }
   try {
     localData = await makeRequest(
@@ -1197,16 +1512,26 @@ export const getImage = async (fullImageName) => {
     }
   }
   if (!localData) {
-    console.log(
-      `Unable to pull ${fullImageName}. Check if the name is valid. Perform any authentication prior to invoking cdxgen.`,
-    );
-    console.log(
-      `Try manually pulling this image using docker pull ${fullImageName}`,
-    );
+    reportImagePullFailure(fullImageName, dockerCmd);
   }
   return localData;
 };
 
+/**
+ * Explain that an image could not be pulled and how to pull it manually.
+ *
+ * @param {string} fullImageName Image that could not be pulled
+ * @param {string} [dockerCmd] Container CLI used for the attempt, if any
+ */
+const reportImagePullFailure = (fullImageName, dockerCmd) => {
+  console.log(
+    `Unable to pull ${fullImageName}. Check if the name is valid. Perform any authentication prior to invoking cdxgen.`,
+  );
+  console.log(
+    `Try manually pulling this image using ${dockerCmd || (isPodman ? "podman" : "docker")} pull ${fullImageName}`,
+  );
+};
+
 /**
  * @typedef {{ path: string }} TarReadEntryLike
  */
@@ -1619,6 +1944,55 @@ export const exportArchive = async (fullImageName, options = {}) => {
   return undefined;
 };
 
+/**
+ * Check that a path taken from an untrusted image archive (manifest layer or
+ * config reference, or a config WorkingDir) stays inside the directory it is
+ * resolved against. Values straight out of manifest.json otherwise traverse
+ * out of the extraction temp dir and read host files into the SBOM.
+ *
+ * @param {string} baseDir Directory the value must resolve within
+ * @param {string} candidatePath Raw value from the archive
+ * @returns {boolean} true when the resolved path is inside (or equal to) baseDir
+ */
+const isPathWithinDir = (baseDir, candidatePath) => {
+  if (typeof candidatePath !== "string" || !candidatePath) {
+    return false;
+  }
+  const relativePath = relative(
+    resolve(baseDir),
+    resolve(baseDir, candidatePath),
+  ).replaceAll("\\", "/");
+  return (
+    relativePath === "" ||
+    (!relativePath.startsWith("..") && !relativePath.split("/").includes(".."))
+  );
+};
+
+/**
+ * Resolve an untrusted archive reference (manifest Layers/Config entry) against
+ * the extraction directory, rejecting anything that escapes it.
+ *
+ * @param {string} tempDir Extraction directory holding the archive contents
+ * @param {string} archiveRef Raw reference string from the archive manifest
+ * @param {string} kind Label used in the skip message
+ * @returns {string|undefined} Contained joined path, or undefined when the
+ *   reference escapes tempDir
+ */
+const resolveContainedArchivePath = (tempDir, archiveRef, kind) => {
+  if (
+    typeof archiveRef !== "string" ||
+    !archiveRef ||
+    isAbsolute(archiveRef) ||
+    !isPathWithinDir(tempDir, archiveRef)
+  ) {
+    console.warn(
+      `Skipping ${kind} '${archiveRef}' from the image manifest: it resolves outside the extracted archive.`,
+    );
+    return undefined;
+  }
+  return join(tempDir, archiveRef);
+};
+
 /**
  * Parse a Docker/containerd manifest file and extract all image layers into a
  * single merged directory. Resolves the last layer's config to determine the
@@ -1676,8 +2050,16 @@ export const extractFromManifest = async (
       layerPhase.progress(extractedLayers, layers.length);
       layerPhase.detail(basename(layer));
       extractedLayers += 1;
+      const containedLayerPath = resolveContainedArchivePath(
+        tempDir,
+        layer,
+        "layer",
+      );
+      if (!containedLayerPath) {
+        continue;
+      }
       try {
-        if (!lstatSync(join(tempDir, layer)).isFile()) {
+        if (!lstatSync(containedLayerPath).isFile()) {
           console.log(
             `Skipping layer ${layer} since it is not a readable file.`,
           );
@@ -1691,7 +2073,7 @@ export const extractFromManifest = async (
         console.log(`Extracting layer ${layer} to ${allLayersExplodedDir}`);
       }
       try {
-        await extractTar(join(tempDir, layer), allLayersExplodedDir, options);
+        await extractTar(containedLayerPath, allLayersExplodedDir, options);
       } catch (err) {
         if (err.code === "TAR_BAD_ARCHIVE") {
           if (DEBUG_MODE) {
@@ -1711,13 +2093,22 @@ export const extractFromManifest = async (
       `${layers.length} layer${layers.length === 1 ? "" : "s"}`,
     );
     if (selectedManifest?.Config) {
-      lastLayerConfigFile = join(tempDir, selectedManifest.Config);
+      lastLayerConfigFile =
+        resolveContainedArchivePath(
+          tempDir,
+          selectedManifest.Config,
+          "config",
+        ) || "";
     }
     if (!lastLayerConfigFile && lastLayer?.includes("layer.tar")) {
-      lastLayerConfigFile = join(
+      const lastLayerPath = resolveContainedArchivePath(
         tempDir,
-        lastLayer.replace("layer.tar", "json"),
+        lastLayer,
+        "layer",
       );
+      if (lastLayerPath) {
+        lastLayerConfigFile = lastLayerPath.replace("layer.tar", "json");
+      }
     }
     if (lastLayerConfigFile && safeExistsSync(lastLayerConfigFile)) {
       try {
@@ -1726,9 +2117,31 @@ export const extractFromManifest = async (
             encoding: "utf-8",
           }),
         );
-        lastWorkingDir = lastLayerConfig.config?.WorkingDir
-          ? join(allLayersExplodedDir, lastLayerConfig.config.WorkingDir)
+        const workingDir = lastLayerConfig.config?.WorkingDir;
+        // WorkingDir is an in-image path (usually absolute such as /app), so
+        // join first to mirror the extraction layout, then keep it only when
+        // the result stays inside the merged layers directory.
+        const candidateWorkingDir = workingDir
+          ? join(allLayersExplodedDir, workingDir)
           : "";
+        const workingDirRelative = candidateWorkingDir
+          ? relative(
+              resolve(allLayersExplodedDir),
+              resolve(candidateWorkingDir),
+            ).replaceAll("\\", "/")
+          : "..";
+        lastWorkingDir =
+          candidateWorkingDir &&
+          (workingDirRelative === "" ||
+            (!workingDirRelative.startsWith("..") &&
+              !workingDirRelative.split("/").includes("..")))
+            ? candidateWorkingDir
+            : "";
+        if (candidateWorkingDir && !lastWorkingDir) {
+          console.warn(
+            `Ignoring image WorkingDir '${workingDir}': it resolves outside the extracted layers.`,
+          );
+        }
       } catch (_err) {
         deferFailOnError(options, {
           ecosystem: "container",
@@ -1773,6 +2186,10 @@ export const exportImage = async (fullImageName, options) => {
   ) {
     return undefined;
   }
+  if (!isSafeImageReference(fullImageName)) {
+    console.log(`${fullImageName} is not a valid container image reference.`);
+    return undefined;
+  }
   if (isDryRun) {
     const imageDetails = parseImageName(fullImageName);
     const requestedRegistryRef = imageDetails.registry
@@ -1819,6 +2236,9 @@ export const exportImage = async (fullImageName, options) => {
       fullImageName,
     ]);
     if (result.status !== 0 || result.error) {
+      if (isWslcCmd(dockerCmd) && isWslcSessionFailure(result.stderr)) {
+        printWslcSessionFailureHint();
+      }
       if (result.stdout || result.stderr) {
         console.log(result.stdout, result.stderr);
       }

package/lib/managers/oci.js

@@ -229,6 +229,35 @@ function getDockerCreds(registry) {
   return readEnvironmentVariable("DOCKER_AUTH");
 }
 
+/**
+ * Check whether a token realm URL belongs to the registry itself.
+ *
+ * A registry's 401 response names the realm, so a hostile registry picks the
+ * URL cdxgen will call. Credentials picked up for the registry must therefore
+ * only be attached when the realm resolves to the same host and port; public
+ * delegating realms (docker.io to auth.docker.io) are still usable, just
+ * anonymously.
+ *
+ * @param {string} registry Registry host, optionally with a port
+ * @param {URL} realmUrl Parsed realm URL from the WWW-Authenticate header
+ * @returns {boolean} true when host and port match the registry
+ */
+export function isSameRegistryHost(registry, realmUrl) {
+  try {
+    const registryUrl = new URL(
+      registry.startsWith("localhost")
+        ? `http://${registry}`
+        : `https://${registry}`,
+    );
+    return (
+      registryUrl.hostname === realmUrl.hostname &&
+      registryUrl.port === realmUrl.port
+    );
+  } catch (_e) {
+    return false;
+  }
+}
+
 async function getOciToken(registry, repository, scope) {
   const creds = getDockerCreds(registry);
   const scheme = registry.startsWith("localhost") ? "http" : "https";
@@ -258,8 +287,17 @@ async function getOciToken(registry, repository, scope) {
             responseType: "json",
             timeout: getOciTimeoutMs(),
           };
-          if (creds) {
+          // The realm comes from the registry's own 401 response, so a
+          // hostile registry chooses this URL. Never forward the stored
+          // registry credentials to a different host; an anonymous cross-host
+          // token request (how public registries such as docker.io delegate
+          // to auth.docker.io) is still allowed.
+          if (creds && isSameRegistryHost(registry, reqUrl)) {
             options.headers = { Authorization: `Basic ${creds}` };
+          } else if (creds) {
+            console.warn(
+              `Skipping credential forwarding to the token realm ${reqUrl.host} for registry ${registry}: the host differs.`,
+            );
           }
           const tokenRes = await cdxgenAgent.get(reqUrl.toString(), options);
           if (