dockerfile: reject an empty COPY or ADD source

frontend/dockerfile/dockerfile2llb/convert_copy.go

@@ -128,6 +128,15 @@ func dispatchCopy(d *dispatchState, cfg copyConfig) error {
 	var a *llb.FileAction
 
 	for _, src := range cfg.params.SourcePaths {
+		if src == "" {
+			// NormalizePath treats an empty path as the parent, which is the
+			// build context root. Reject it before that rewrite.
+			name := "COPY"
+			if cfg.isAddCommand {
+				name = "ADD"
+			}
+			return errors.Errorf("%s source can't be empty", name)
+		}
 		commitMessage.WriteString(" " + src)
 		gitRef, isGit, gitRefErr := dfgitutil.ParseGitRef(src)
 		if gitRefErr != nil && isGit {

frontend/dockerfile/dockerfile2llb/convert_test.go

@@ -545,3 +545,39 @@ func TestCopyLinkChownByName(t *testing.T) {
 		})
 	}
 }
+
+func TestCopyEmptySource(t *testing.T) {
+	t.Parallel()
+	for _, tc := range []struct {
+		name string
+		df   string
+		err  string
+	}{
+		{
+			name: "json",
+			df:   "FROM scratch\nCOPY [\"\", \"/tmp/file\"]\n",
+			err:  "COPY source can't be empty",
+		},
+		{
+			name: "quoted",
+			df:   "FROM scratch\nCOPY \"\" /tmp/file\n",
+			err:  "COPY source can't be empty",
+		},
+		{
+			name: "expanded",
+			df:   "FROM scratch\nARG EMPTY\nCOPY ${EMPTY} /tmp/file\n",
+			err:  "COPY source can't be empty",
+		},
+		{
+			name: "add",
+			df:   "FROM scratch\nADD [\"\", \"/tmp/file\"]\n",
+			err:  "ADD source can't be empty",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			_, err := Dockerfile2LLB(appcontext.Context(), []byte(tc.df), ConvertOpt{})
+			require.ErrorContains(t, err, tc.err)
+		})
+	}
+}