{"record":{"id":"560fdd6ef94e7f4e","repo":"docker/cli","slug":"unexpected-context-file","errorCode":null,"errorMessage":"unexpected context file","messagePattern":"unexpected context file","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/context/store/store.go","lineNumber":373,"sourceCode":"\t// Buffered reader will not advance the buffer, needed to determine content type\n\tr := bufio.NewReader(reader)\n\n\timportContentType, err := getImportContentType(r)\n\tif err != nil {\n\t\treturn err\n\t}\n\tswitch importContentType {\n\tcase zipType:\n\t\treturn importZip(name, s, r)\n\tdefault:\n\t\t// Assume it's a TAR (TAR does not have a \"magic number\")\n\t\treturn importTar(name, s, r)\n\t}\n}\n\nfunc isValidFilePath(p string) error {\n\tif p != metaFile && !strings.HasPrefix(p, \"tls/\") {\n\t\treturn errors.New(\"unexpected context file\")\n\t}\n\tif path.Clean(p) != p {\n\t\treturn errors.New(\"unexpected path format\")\n\t}\n\tif strings.Contains(p, `\\`) {\n\t\treturn errors.New(`unexpected '\\' in path`)\n\t}\n\treturn nil\n}\n\nfunc importTar(name string, s Writer, reader io.Reader) error {\n\ttr := tar.NewReader(&limitedReader{R: reader, N: maxAllowedFileSizeToImport})\n\ttlsData := ContextTLSData{\n\t\tEndpoints: map[string]EndpointTLSData{},\n\t}\n\tvar importedMetaFile bool\n\tfor {\n\t\thdr, err := tr.Next()","sourceCodeStart":355,"sourceCodeEnd":391,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/context/store/store.go#L355-L391","documentation":"Returned by isValidFilePath during context archive import: an entry's path must be either the metadata file (metaFile) or live under the 'tls/' prefix. Any other file is rejected because a context archive may only contain metadata and TLS material, preventing arbitrary file writes outside the expected layout.","triggerScenarios":"Importing a tar/zip archive that contains files at the root or in unexpected directories (e.g. 'readme.txt', 'certs/ca.pem' instead of 'tls/...'). A tampered or hand-built archive including extra entries.","commonSituations":"A user zips a whole folder including non-context files. An export tool adds unexpected artifacts. Path manipulation in a crafted archive.","solutions":["Re-export the context from a valid source so the archive contains only meta.json and tls/* entries.","Manually remove non-conforming entries from the archive before importing.","Ensure TLS files are placed under the 'tls/<endpoint>/' path within the archive."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Reject archives with unexpected entries before importing.\nfor _, e := range entries {\n    if e != metaFile && !strings.HasPrefix(e, \"tls/\") {\n        return fmt.Errorf(\"unexpected file in archive: %s\", e)\n    }\n}","typeGuard":"func isAllowedContextPath(p string) bool {\n    return p == metaFile || strings.HasPrefix(p, \"tls/\")\n}","tryCatchPattern":null,"preventionTips":["Only import archives produced by 'docker context export'.","Inspect archives with 'tar -tf' / 'unzip -l' before importing.","Never include arbitrary files in a context archive."],"tags":["context","import","archive","security","path-traversal"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}