explicitly reject updates to non-spec imagestreamtags

openshift · Feb 14, 2018 · be881c9 · be881c9
1 parent 4957392
commit be881c9
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/pkg/image/registry/imagestreamtag/rest.go b/pkg/image/registry/imagestreamtag/rest.go
@@ -263,6 +263,11 @@ func (r *REST) Update(ctx apirequest.Context, tagName string, objInfo rest.Updat
 		imageStream.Spec.Tags = map[string]imageapi.TagReference{}
 	}
 	tagRef, exists := imageStream.Spec.Tags[tag]
+
+	if !exists {
+		return nil, false, kapierrors.NewBadRequest(fmt.Sprintf("imagestreamtag %s is not a spec tag in imagestream %s/%s, cannot be updated", tag, imageStream.Namespace, imageStream.Name))
+	}
+
 	// if the caller set tag, override the spec tag
 	if istag.Tag != nil {
 		tagRef = *istag.Tag