{"record":{"id":"f684e3f7934bc3a7","repo":"docker/cli","slug":"s-w-f684e3","errorCode":null,"errorMessage":"%s: %w","messagePattern":"%s: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/context/store/store.go","lineNumber":403,"sourceCode":"\ttr := tar.NewReader(&limitedReader{R: reader, N: maxAllowedFileSizeToImport})\n\ttlsData := ContextTLSData{\n\t\tEndpoints: map[string]EndpointTLSData{},\n\t}\n\tvar importedMetaFile bool\n\tfor {\n\t\thdr, err := tr.Next()\n\t\tif err == io.EOF {\n\t\t\tbreak\n\t\t}\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif hdr.Typeflag != tar.TypeReg {\n\t\t\t// skip this entry, only taking files into account\n\t\t\tcontinue\n\t\t}\n\t\tif err := isValidFilePath(hdr.Name); err != nil {\n\t\t\treturn fmt.Errorf(\"%s: %w\", hdr.Name, err)\n\t\t}\n\t\tif hdr.Name == metaFile {\n\t\t\tdata, err := io.ReadAll(tr)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tmeta, err := parseMetadata(data, name)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tif err := s.CreateOrUpdate(meta); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\timportedMetaFile = true\n\t\t} else if strings.HasPrefix(hdr.Name, \"tls/\") {\n\t\t\tdata, err := io.ReadAll(tr)\n\t\t\tif err != nil {\n\t\t\t\treturn err","sourceCodeStart":385,"sourceCodeEnd":421,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/context/store/store.go#L385-L421","documentation":"Returned during tar context Import when an archive entry's path fails isValidFilePath: paths must be exactly 'meta.json' or start with 'tls/', must equal path.Clean(p) (no '..' or '.' traversal, no duplicates), and must contain no backslashes. The offending entry name is included in the message.","triggerScenarios":"Calling store.Import / `docker context import` on a tar containing entries outside the allowed layout: '../escape', 'tls/../x', 'tls\\docker\\ca.pem' (backslashes), or stray top-level files.","commonSituations":"Hand-rolled or tampered context archives; archives from incompatible tools; path-traversal (tar-slip) attempts.","solutions":["Re-export the context from a known-good CLI (`docker context export`) and import that archive.","Inspect the archive (`tar -tvf file`) and remove disallowed entries.","Ensure all entry paths use forward slashes and a meta.json / tls/-prefixed layout."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Pre-check a tar's entries before importing.\nfunc safeTarEntries(r io.Reader) error {\n    tr := tar.NewReader(r)\n    for {\n        h, err := tr.Next()\n        if err == io.EOF { return nil }\n        if err != nil { return err }\n        if h.Name != \"meta.json\" && !strings.HasPrefix(h.Name, \"tls/\") {\n            return fmt.Errorf(\"disallowed entry %q\", h.Name)\n        }\n        if path.Clean(h.Name) != h.Name || strings.Contains(h.Name, `\\`) {\n            return fmt.Errorf(\"unsafe path %q\", h.Name)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only import context archives produced by `docker context export`.","Inspect a tar (`tar -tvf`) before importing untrusted archives.","Reject archives with backslashes or '..' segments outright (tar-slip protection)."],"tags":["context","import","tar","security","path-traversal"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}