From 18f46883851e47387ec2bd116940cdae97ba3c8d Mon Sep 17 00:00:00 2001
From: Josh Hawn <josh.hawn@docker.com>
Date: Wed, 22 Apr 2015 14:41:24 -0700
Subject: [PATCH] Validate repo name before image pull

Checks for reserved 'scratch' image name.

fixes #12281

Docker-DCO-1.1-Signed-off-by: Josh Hawn <josh.hawn@docker.com> (github: jlhawn)
---
 graph/pull.go                           |  4 ++++
 integration-cli/docker_cli_pull_test.go | 19 +++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/graph/pull.go b/graph/pull.go
index b62591ffb6..ac814a2340 100644
--- a/graph/pull.go
+++ b/graph/pull.go
@@ -39,6 +39,10 @@ func (s *TagStore) Pull(image string, tag string, imagePullConfig *ImagePullConf
 		return err
 	}
 
+	if err := validateRepoName(repoInfo.LocalName); err != nil {
+		return err
+	}
+
 	c, err := s.poolAdd("pull", utils.ImageReference(repoInfo.LocalName, tag))
 	if err != nil {
 		if c != nil {
diff --git a/integration-cli/docker_cli_pull_test.go b/integration-cli/docker_cli_pull_test.go
index 8cf09a7261..a4d4c977bb 100644
--- a/integration-cli/docker_cli_pull_test.go
+++ b/integration-cli/docker_cli_pull_test.go
@@ -134,3 +134,22 @@ func (s *DockerSuite) TestPullImageOfficialNames(c *check.C) {
 		}
 	}
 }
+
+func (s *DockerSuite) TestPullScratchNotAllowed(c *check.C) {
+	testRequires(c, Network)
+
+	pullCmd := exec.Command(dockerBinary, "pull", "scratch")
+	out, exitCode, err := runCommandWithOutput(pullCmd)
+	if err == nil {
+		c.Fatal("expected pull of scratch to fail, but it didn't")
+	}
+	if exitCode != 1 {
+		c.Fatalf("pulling scratch expected exit code 1, got %d", exitCode)
+	}
+	if strings.Contains(out, "Pulling repository scratch") {
+		c.Fatalf("pulling scratch should not have begun: %s", out)
+	}
+	if !strings.Contains(out, "'scratch' is a reserved name") {
+		c.Fatalf("unexpected output pulling scratch: %s", out)
+	}
+}