From 4619b6c23ad0a448f469cd2d452d9d4966c5bf2c Mon Sep 17 00:00:00 2001
From: Ben Parees <bparees@redhat.com>
Date: Thu, 8 Feb 2018 13:47:58 -0500
Subject: [PATCH] explicitly reject updates to non-spec imagestreamtags

---
 pkg/image/registry/imagestreamtag/rest.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkg/image/registry/imagestreamtag/rest.go b/pkg/image/registry/imagestreamtag/rest.go
index c810bca33044..69fdd8494a0a 100644
--- a/pkg/image/registry/imagestreamtag/rest.go
+++ b/pkg/image/registry/imagestreamtag/rest.go
@@ -263,6 +263,11 @@ func (r *REST) Update(ctx apirequest.Context, tagName string, objInfo rest.Updat
 		imageStream.Spec.Tags = map[string]imageapi.TagReference{}
 	}
 	tagRef, exists := imageStream.Spec.Tags[tag]
+
+	if !exists && istag.Tag == nil {
+		return nil, false, kapierrors.NewBadRequest(fmt.Sprintf("imagestreamtag %s is not a spec tag in imagestream %s/%s, cannot be updated", tag, imageStream.Namespace, imageStream.Name))
+	}
+
 	// if the caller set tag, override the spec tag
 	if istag.Tag != nil {
 		tagRef = *istag.Tag