CVE-2024-36127

@@ -16,6 +16,7 @@ package types
 
 import (
 	"fmt"
+	"net/url"
 	"runtime"
 	"sort"
 
@@ -95,6 +96,33 @@ type ImageContents struct {
 	BaseImage *BaseImageDescriptor `json:"baseimage,omitempty" yaml:"baseimage,omitempty"`
 }
 
+// MarshalYAML implements yaml.Marshaler for ImageContents, redacting URLs in
+// the ImageContents struct fields.
+func (i ImageContents) MarshalYAML() (interface{}, error) {
+	type redactedImageContents ImageContents
+	ri := redactedImageContents(i)
+
+	for idx, repo := range ri.Repositories {
+		rawURL := repo
+		parsed, err := url.Parse(rawURL)
+		if err != nil {
+			return nil, fmt.Errorf("parsing repository URL: %w", err)
+		}
+		ri.Repositories[idx] = parsed.Redacted()
+	}
+
+	for idx, key := range ri.Keyring {
+		rawURL := key
+		parsed, err := url.Parse(rawURL)
+		if err != nil {
+			return nil, fmt.Errorf("parsing public key URL: %w", err)
+		}
+		ri.Keyring[idx] = parsed.Redacted()
+	}
+
+	return ri, nil
+}
+
 type ImageEntrypoint struct {
 	// Optional: The type of entrypoint. Only "service-bundle" is supported.
 	Type string `json:"type,omitempty"`