Removing volumes

[bsponge]

Description

I'm not sure if this is a bug.

moby/client/volume_remove.go

Line 24 in 7c8d02d

resp, err := cli.delete(ctx, "/volumes/"+volumeID, query, nil)

Shouldn't volumeID be escaped as it is used directly in URL?
I mean something like this:

resp, err := cli.delete(ctx, "/volumes/"+url.QueryEscape(volumeID), query, nil)

Reproduce

does not apply

Expected behavior

does not apply

docker version

does not apply

docker info

does not apply

Additional Info

No response

[thaJeztah]

Thanks for reporting. Yes, this is a known issue, and far from ideal; there's been some prior work on changing this, but it turned out to be move involved to prevent it being a backward-breaking change (as different combinations of client and daemon are possible, and changing behavior on either side can cause issues). At the time, there were also some issues with the gorilla/mux library used, but I think those were fixed since. Some of the earlier issues and pull-requests;

• Fix docker cli silently does nothing when provided a slash-prefixed container name #16577
• UrlEncode user input in client #29131
• fixes: urlencode containerid and other id when add to url in client library #37857
• fixes: no name check in docker container command docker/cli#1331