Ensure that tag name is not empty if name contains colon (#2094)

Author: SaschaSchwarze0

pkg/name/digest_test.go

@@ -55,6 +55,7 @@ var badDigestNames = []string{
 	"repo@sha256:" + strings.Repeat(":", 64),
 	"repo@sha256:" + strings.Repeat("sh", 32),
 	"repo@sha256:" + validDigest + "@" + validDigest,
+	"library/nginx:@" + validDigest,
 }
 
 func TestNewDigestStrictValidation(t *testing.T) {

pkg/name/tag.go

@@ -85,6 +85,9 @@ func NewTag(name string, opts ...Option) (Tag, error) {
 	if len(parts) > 1 && !strings.Contains(parts[len(parts)-1], regRepoDelimiter) {
 		base = strings.Join(parts[:len(parts)-1], tagDelim)
 		tag = parts[len(parts)-1]
+		if tag == "" {
+			return Tag{}, newErrBadName("%s must specify a tag name after the colon", name)
+		}
 	}
 
 	// We don't require a tag, but if we get one check it's valid,

pkg/name/tag_test.go

@@ -40,6 +40,7 @@ var badTagNames = []string{
 	"gcr.io/project-id/bad_chars:c@n'tuse",
 	"gcr.io/project-id/wrong-length:white space",
 	"gcr.io/project-id/too-many-chars:thisisthetagthatneverendsitgoesonandonmyfriendsomepeoplestartedtaggingitnotknowingwhatitwasandtheyllcontinuetaggingitforeverjustbecausethisisthetagthatneverends",
+	"library/ubuntu:",
 }
 
 func TestNewTagStrictValidation(t *testing.T) {

pkg/v1/remote/error_roundtrip_test.go

@@ -55,7 +55,7 @@ func TestStatusCodeReturned(t *testing.T) {
 			o := httptest.NewServer(tc.Handler)
 			defer o.Close()
 
-			ref, err := name.NewDigest(strings.TrimPrefix(o.URL+"/foo:@sha256:53b27244ffa2f585799adbfaf79fba5a5af104597751b289c8b235e7b8f7ebf5", "http://"))
+			ref, err := name.NewDigest(strings.TrimPrefix(o.URL+"/foo@sha256:53b27244ffa2f585799adbfaf79fba5a5af104597751b289c8b235e7b8f7ebf5", "http://"))
 
 			if err != nil {
 				t.Fatalf("Unable to parse digest: %v", err)