CVE-2022-4123

@@ -241,7 +241,9 @@ func Build(ctx context.Context, containerFiles []string, options entities.BuildO
 			params.Add("platform", platform)
 		}
 	}
-	if contextDir, err := filepath.EvalSymlinks(options.ContextDirectory); err == nil {
+	var err error
+	var contextDir string
+	if contextDir, err = filepath.EvalSymlinks(options.ContextDirectory); err == nil {
 		options.ContextDirectory = contextDir
 	}
 
@@ -301,7 +303,6 @@ func Build(ctx context.Context, containerFiles []string, options entities.BuildO
 
 	var (
 		headers http.Header
-		err     error
 	)
 	if options.SystemContext != nil && options.SystemContext.DockerAuthConfig != nil {
 		headers, err = auth.MakeXRegistryAuthHeader(options.SystemContext, options.SystemContext.DockerAuthConfig.Username, options.SystemContext.DockerAuthConfig.Password)
@@ -325,7 +326,7 @@ func Build(ctx context.Context, containerFiles []string, options entities.BuildO
 		}
 	}
 
-	contextDir, err := filepath.Abs(options.ContextDirectory)
+	contextDir, err = filepath.Abs(options.ContextDirectory)
 	if err != nil {
 		logrus.Errorf("Cannot find absolute path of %v: %v", options.ContextDirectory, err)
 		return nil, err
@@ -556,16 +557,27 @@ func nTar(excludes []string, sources ...string) (io.ReadCloser, error) {
 				merr = multierror.Append(merr, err)
 				return
 			}
-
 			err = filepath.Walk(s, func(path string, info os.FileInfo, err error) error {
 				if err != nil {
 					return err
 				}
 
-				if path == s {
-					return nil // skip root dir
+				// check if what we are given is an empty dir, if so then continue w/ it. Else return.
+				// if we are given a file or a symlink, we do not want to exclude it.
+				if info.IsDir() && s == path {
+					var p *os.File
+					p, err = os.Open(path)
+					if err != nil {
+						return err
+					}
+					defer p.Close()
+					_, err = p.Readdir(1)
+					if err != io.EOF {
+						return nil // non empty root dir, need to return
+					} else if err != nil {
+						logrus.Errorf("Error while reading directory %v: %v", path, err)
+					}
 				}
-
 				name := filepath.ToSlash(strings.TrimPrefix(path, s+string(filepath.Separator)))
 
 				excluded, err := pm.Matches(name) // nolint:staticcheck

@@ -734,10 +734,11 @@ RUN ls /dev/test1`, ALPINE)
 		err = os.Mkdir("relative", 0755)
 		Expect(err).To(BeNil())
 		containerFilePath := filepath.Join("relative", "Containerfile")
-		fmt.Println(containerFilePath)
+		err = os.Mkdir("relative/build-root", 0755)
+		Expect(err).To(BeNil())
 		err = ioutil.WriteFile(containerFilePath, []byte(containerFile), 0755)
 		Expect(err).To(BeNil())
-		build := podmanTest.Podman([]string{"build", "-f", "./relative/Containerfile"})
+		build := podmanTest.Podman([]string{"build", "-f", "./relative/Containerfile", "./relative/build-root"})
 		build.WaitWithDefaultTimeout()
 		Expect(build).To(Exit(0))
 		err = os.RemoveAll("relative")