CVE-2016-1906

@@ -49,6 +49,11 @@ func (a *buildByStrategy) Admit(attr admission.Attributes) error {
 	if resource := attr.GetResource(); resource != buildsResource && resource != buildConfigsResource {
 		return nil
 	}
+	// Explicitly exclude the builds/details subresource because it's only
+	// updating commit info and cannot change build type.
+	if attr.GetResource() == buildsResource && attr.GetSubresource() == "details" {
+		return nil
+	}
 	switch obj := attr.GetObject().(type) {
 	case *buildapi.Build:
 		return a.checkBuildAuthorization(obj, attr)

@@ -128,6 +128,15 @@ func TestBuildAdmission(t *testing.T) {
 			expectAccept:   false,
 			expectedError:  "Internal error occurred: [Unrecognized request object &admission.fakeObject{}, couldn't find ObjectMeta field in admission.fakeObject{}]",
 		},
+		{
+			name:           "details on forbidden docker build",
+			object:         testBuild(buildapi.BuildStrategy{DockerStrategy: &buildapi.DockerBuildStrategy{}}),
+			kind:           "Build",
+			resource:       buildsResource,
+			subResource:    "details",
+			reviewResponse: reviewResponse(false, "cannot create build of type docker build"),
+			expectAccept:   true,
+		},
 	}
 
 	ops := []admission.Operation{admission.Create, admission.Update}