api/build: send only the Dockerfile name in the query string

docker/api/build.py

@@ -160,6 +160,9 @@ def build(self, path=None, tag=None, quiet=False, fileobj=None,
                 path, exclude=exclude, dockerfile=dockerfile, gzip=gzip
             )
             encoding = 'gzip' if gzip else encoding
+            # Only the name goes in the query string. The contents of an
+            # out-of-context Dockerfile are already in the archive.
+            dockerfile = dockerfile[0]
 
         u = self._url('/build')
         params = {

tests/unit/api_build_test.py

@@ -118,6 +118,29 @@ def test_build_remote_with_registry_auth(self):
     def test_build_container_with_named_dockerfile(self):
         self.client.build(".", dockerfile="nameddockerfile")
 
+    def test_build_in_context_dockerfile_param(self):
+        base = make_tree([], ["custom.dockerfile"])
+        self.addCleanup(shutil.rmtree, base)
+
+        self.client.build(base, dockerfile="custom.dockerfile")
+
+        params = fake_request.call_args[1]["params"]
+        assert params["dockerfile"] == "custom.dockerfile"
+
+    def test_build_out_of_context_dockerfile_param(self):
+        base = make_tree(["context"], ["Dockerfile"])
+        self.addCleanup(shutil.rmtree, base)
+        with open(f"{base}/Dockerfile", "w") as df:
+            df.write("FROM busybox\nCOPY . /src\n")
+
+        self.client.build(f"{base}/context", dockerfile=f"{base}/Dockerfile")
+
+        # The Dockerfile is sent in the archive under a generated name. Its
+        # contents must not end up in the query string.
+        params = fake_request.call_args[1]["params"]
+        assert isinstance(params["dockerfile"], str)
+        assert params["dockerfile"].startswith(".dockerfile.")
+
     def test_build_with_invalid_tag(self):
         with pytest.raises(errors.DockerException):
             self.client.build(".", tag="https://example.com")