Repository: moby/moby
File: daemon/containerd/registry_errors.go (Go)

Code before:

type tokenServerError struct {
	Details string `json:"details"`
}

func translateRegistryError(ctx context.Context, err error) error {
	// Check for registry specific error
	var derrs docker.Errors
	if !errors.As(err, &derrs) {
		var remoteErr remoteerrors.ErrUnexpectedStatus
		if errors.As(err, &remoteErr) {
			if jerr := json.Unmarshal(remoteErr.Body, &derrs); jerr != nil {
				log.G(ctx).WithError(derrs).Debug("unable to unmarshal registry error")
				return fmt.Errorf("%w: %w", cerrdefs.ErrUnknown, err)
			}
			if len(derrs) == 0 {
				if remoteErr.StatusCode == http.StatusUnauthorized || remoteErr.StatusCode == http.StatusForbidden {
					// Token server may have a unique response
					var tokenErr tokenServerError
					if jerr := json.Unmarshal(remoteErr.Body, &tokenErr); jerr == nil && tokenErr.Details != "" {
						if remoteErr.StatusCode == http.StatusUnauthorized {
							return cerrdefs.ErrUnauthenticated.WithMessage(fmt.Sprintf("%s - %s", docker.ErrorCodeUnauthorized.Message(), tokenErr.Details))
						} else {
							return cerrdefs.ErrPermissionDenied.WithMessage(fmt.Sprintf("%s - %s", docker.ErrorCodeDenied.Message(), tokenErr.Details))

						}
					}

				}
			}
		} else {
			var derr docker.Error
			if errors.As(err, &derr) {
				derrs = append(derrs, derr)
			} else {
				return err
			}
		}
	}
	var errs []error
	for _, err := range derrs {
		var derr docker.Error
		if errors.As(err, &derr) {
			var message string

			if derr.Message != "" {
				message = derr.Message
			} else {
				message = derr.Code.Message()
			}


Review comment (security):
nit; looks like some stray whitespace; the `else` also is redundant, and may start to trip some linters we added / are adding;

```suggestion
			if len(derrs) == 0 {
				if remoteErr.StatusCode == http.StatusUnauthorized || remoteErr.StatusCode == http.StatusForbidden {
					// Token server may have a unique response
					var tokenErr tokenServerError
					if jErr := json.Unmarshal(remoteErr.Body, &tokenErr); jErr == nil && tokenErr.Details != "" {
						if remoteErr.StatusCode == http.StatusUnauthorized {
							return cerrdefs.ErrUnauthenticated.WithMessage(fmt.Sprintf("%s - %s", docker.ErrorCodeUnauthorized.Message(), tokenErr.Details))
						}
						return cerrdefs.ErrPermissionDenied.WithMessage(fmt.Sprintf("%s - %s", docker.ErrorCodeDenied.Message(), tokenErr.Details))
					}
				}
			}
```



Code after:

func translateRegistryError(ctx context.Context, err error) error {
	// Check for registry specific error
	var derrs docker.Errors
	if !errors.As(err, &derrs) {
		var remoteErr remoteerrors.ErrUnexpectedStatus
		if errors.As(err, &remoteErr) {
			if jerr := json.Unmarshal(remoteErr.Body, &derrs); jerr != nil {
				log.G(ctx).WithError(derrs).Debug("unable to unmarshal registry error")
				return fmt.Errorf("%w: %w", cerrdefs.ErrUnknown, err)
			}
			if len(derrs) == 0 {
				if remoteErr.StatusCode == http.StatusUnauthorized || remoteErr.StatusCode == http.StatusForbidden {
					// Some registries or token servers may use an old deprecated error format
					// which only has a "details" field and not the OCI defined "errors" array.
					var tokenErr struct {
						Details string `json:"details"`
					}
					if jerr := json.Unmarshal(remoteErr.Body, &tokenErr); jerr == nil && tokenErr.Details != "" {
						if remoteErr.StatusCode == http.StatusUnauthorized {
							return cerrdefs.ErrUnauthenticated.WithMessage(fmt.Sprintf("%s - %s", docker.ErrorCodeUnauthorized.Message(), tokenErr.Details))
						}
						return cerrdefs.ErrPermissionDenied.WithMessage(fmt.Sprintf("%s - %s", docker.ErrorCodeDenied.Message(), tokenErr.Details))
					}
				}
			}
		} else {
			var derr docker.Error
			if errors.As(err, &derr) {
				derrs = append(derrs, derr)
			} else {
				return err
			}
		}
	}
	var errs []error
	for _, err := range derrs {
		var derr docker.Error
		if errors.As(err, &derr) {
			var message string

			if derr.Message != "" {
				message = derr.Message
			} else {
				message = derr.Code.Message()
			}

			if detail, ok := derr.Detail.(string); ok {
				message = fmt.Sprintf("%s - %s", message, detail)
			}