Fix possible CME while replacing properties (#2416)

eddumelendez · tkrah · web-flow · commit d9b653361df9 · 2025-04-01T14:43:32.000-06:00
Fixes #2274 --------- Co-authored-by: Torsten Krah <krah.tm@gmail.com>
diff --git a/docker-java-core/src/main/java/com/github/dockerjava/core/DefaultDockerClientConfig.java b/docker-java-core/src/main/java/com/github/dockerjava/core/DefaultDockerClientConfig.java
@@ -5,6 +5,8 @@
 import com.github.dockerjava.api.model.AuthConfigurations;
 import com.github.dockerjava.core.NameParser.HostnameReposName;
 import com.github.dockerjava.core.NameParser.ReposTag;
+
+import java.util.Map.Entry;
 import java.util.Optional;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.SystemUtils;
@@ -128,9 +130,11 @@ private static Properties loadIncludedDockerProperties(Properties systemProperti
     }
 
     private static void replaceProperties(Properties properties, Properties replacements) {
-        for (Object objectKey : properties.keySet()) {
-            String key = objectKey.toString();
-            properties.setProperty(key, replaceProperties(properties.getProperty(key), replacements));
+        for (Entry<Object, Object> entry : properties.entrySet()) {
+            final String key = entry.getKey().toString();
+            // no entry.getValue here because it does not have the same semantics as getProperty (defaults handling)
+            final String value = properties.getProperty(key);
+            entry.setValue(replaceProperties(value, replacements));
         }
     }
 
