* [pmg-devel] [PATCH pmg-api v3] fix #4811: rule db: test regex validity on save
@ 2023-12-21 12:05 Dominik Csapak
2024-02-14 6:26 ` [pmg-devel] applied: " Stoiko Ivanov
0 siblings, 1 reply; 2+ messages in thread
From: Dominik Csapak @ 2023-12-21 12:05 UTC (permalink / raw)
To: pmg-devel
and warn only when it's an invalid regex on execution, because users may
have previously had such rules. Otherwise, pmg-smtp-filter will restart
every time it encounters such a rule.
When testing, 'die' if the regex execution 'warns', so that users cannot
enter a semi-invalid or very wrong regex like '^*foo$'.
do so for every rule type that uses a regex to match
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
src/PMG/RuleDB/ArchiveFilter.pm | 6 ++++++
src/PMG/RuleDB/ContentTypeFilter.pm | 7 +++++++
src/PMG/RuleDB/MatchArchiveFilename.pm | 7 +++++++
src/PMG/RuleDB/MatchField.pm | 4 +---
src/PMG/RuleDB/MatchFilename.pm | 12 +++++++++---
src/PMG/RuleDB/WhoRegex.pm | 10 +++++++++-
src/PMG/Utils.pm | 10 ++++++++++
7 files changed, 49 insertions(+), 7 deletions(-)
diff --git a/src/PMG/RuleDB/ArchiveFilter.pm b/src/PMG/RuleDB/ArchiveFilter.pm
index 6d91556..3d9890c 100644
--- a/src/PMG/RuleDB/ArchiveFilter.pm
+++ b/src/PMG/RuleDB/ArchiveFilter.pm
@@ -48,6 +48,12 @@ sub parse_entity {
my $res;
+ # test regex for validity
+ eval { "" =~ m|$self->{field_value}|; };
+ if (my $err = $@) {
+ warn "invalid regex: $err\n";
+ return $res;
+ }
# match subtypes? We currently do exact matches only.
if (my $id = $entity->head->mime_attr ('x-proxmox-tmp-aid')) {
diff --git a/src/PMG/RuleDB/ContentTypeFilter.pm b/src/PMG/RuleDB/ContentTypeFilter.pm
index 76fc1ce..0199311 100644
--- a/src/PMG/RuleDB/ContentTypeFilter.pm
+++ b/src/PMG/RuleDB/ContentTypeFilter.pm
@@ -60,6 +60,13 @@ sub parse_entity {
my $res;
+ # test regex for validity
+ eval { "" =~ m|$self->{field_value}|; };
+ if (my $err = $@) {
+ warn "invalid regex: $err\n";
+ return $res;
+ }
+
# match subtypes? We currently do exact matches only.
if (my $id = $entity->head->mime_attr ('x-proxmox-tmp-aid')) {
diff --git a/src/PMG/RuleDB/MatchArchiveFilename.pm b/src/PMG/RuleDB/MatchArchiveFilename.pm
index 2ef3543..5b1cb6d 100644
--- a/src/PMG/RuleDB/MatchArchiveFilename.pm
+++ b/src/PMG/RuleDB/MatchArchiveFilename.pm
@@ -25,6 +25,13 @@ sub parse_entity {
my $res;
+ # test regex for validity
+ eval { "" =~ m|^$self->{fname}$|i; };
+ if (my $err = $@) {
+ warn "invalid regex: $err\n";
+ return $res;
+ }
+
if (my $id = $entity->head->mime_attr('x-proxmox-tmp-aid')) {
chomp $id;
diff --git a/src/PMG/RuleDB/MatchField.pm b/src/PMG/RuleDB/MatchField.pm
index 177a283..ee1851a 100644
--- a/src/PMG/RuleDB/MatchField.pm
+++ b/src/PMG/RuleDB/MatchField.pm
@@ -71,9 +71,7 @@ sub save {
my $regex = $self->{field_value};
- # test regex for validity
- eval { "" =~ /$regex/i; };
- die "invalid regex: $@\n" if $@;
+ PMG::Utils::test_regex($regex);
my $new_value = "$self->{field}:$regex";
$new_value =~ s/\\/\\\\/g;
diff --git a/src/PMG/RuleDB/MatchFilename.pm b/src/PMG/RuleDB/MatchFilename.pm
index c9cdbe0..90f8654 100644
--- a/src/PMG/RuleDB/MatchFilename.pm
+++ b/src/PMG/RuleDB/MatchFilename.pm
@@ -58,6 +58,9 @@ sub save {
defined($self->{ogroup}) || die "undefined ogroup: ERROR";
my $new_value = $self->{fname};
+
+ PMG::Utils::test_regex("^${new_value}\$");
+
$new_value =~ s/\\/\\\\/g;
$new_value = encode('UTF-8', $new_value);
@@ -91,9 +94,12 @@ sub parse_entity {
chomp $id;
if (my $value = PMG::Utils::extract_filename($entity->head)) {
- if ($value =~ m|^$self->{fname}$|i) {
- push @$res, $id;
- }
+ eval {
+ if ($value =~ m|^$self->{fname}$|i) {
+ push @$res, $id;
+ }
+ };
+ warn "invalid regex: $@\n" if $@;
}
}
diff --git a/src/PMG/RuleDB/WhoRegex.pm b/src/PMG/RuleDB/WhoRegex.pm
index 5c13604..03405bc 100644
--- a/src/PMG/RuleDB/WhoRegex.pm
+++ b/src/PMG/RuleDB/WhoRegex.pm
@@ -60,6 +60,9 @@ sub save {
defined($self->{address}) || die "undefined address: ERROR";
my $adr = $self->{address};
+
+ PMG::Utils::test_regex("^${adr}\$");
+
$adr =~ s/\\/\\\\/g;
$adr = encode('UTF-8', $adr);
@@ -100,7 +103,12 @@ sub who_match {
my $t = $self->address;
- return $addr =~ m/^$t$/i;
+ my $res;
+ eval {
+ $res = $addr =~ m/^$t$/i;
+ };
+ warn "invalid regex: $@\n" if $@;
+ return $res;
}
sub address {
diff --git a/src/PMG/Utils.pm b/src/PMG/Utils.pm
index d9c9d2d..da1d81b 100644
--- a/src/PMG/Utils.pm
+++ b/src/PMG/Utils.pm
@@ -1580,4 +1580,14 @@ sub try_decode_utf8 {
return eval { decode('UTF-8', $data, 1) } // $data;
}
+sub test_regex {
+ my ($regex) = @_;
+
+ local $SIG{__WARN__} = sub { die @_ };
+ eval { "" =~ m/$regex/i; };
+ die "invalid regex: $@\n" if $@;
+
+ return undef;
+}
+
1;
--
2.39.2
^ permalink raw reply [flat|nested] 2+ messages in thread
* [pmg-devel] applied: [PATCH pmg-api v3] fix #4811: rule db: test regex validity on save
2023-12-21 12:05 [pmg-devel] [PATCH pmg-api v3] fix #4811: rule db: test regex validity on save Dominik Csapak
@ 2024-02-14 6:26 ` Stoiko Ivanov
0 siblings, 0 replies; 2+ messages in thread
From: Stoiko Ivanov @ 2024-02-14 6:26 UTC (permalink / raw)
To: Dominik Csapak; +Cc: pmg-devel
Thanks for the rework - works really nice now!
applied with a small comment inserted in test_regex giving 2 examples
of regex causing warn and die respectively
a patch-version changelog would have helped me a bit (then again reviewing
the third version earlier would have done so as well).
On Thu, Dec 21, 2023 at 01:05:08PM +0100, Dominik Csapak wrote:
> and warn only when it's an invalid regex on execution, because users may
> have previously had such rules. Otherwise, pmg-smtp-filter will restart
> every time it encounters such a rule.
>
> When testing, 'die' if the regex execution 'warns', so that users cannot
> enter a semi-invalid or very wrong regex like '^*foo$'.
>
> do so for every rule type that uses a regex to match
>
> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
> ---
> src/PMG/RuleDB/ArchiveFilter.pm | 6 ++++++
> src/PMG/RuleDB/ContentTypeFilter.pm | 7 +++++++
> src/PMG/RuleDB/MatchArchiveFilename.pm | 7 +++++++
> src/PMG/RuleDB/MatchField.pm | 4 +---
> src/PMG/RuleDB/MatchFilename.pm | 12 +++++++++---
> src/PMG/RuleDB/WhoRegex.pm | 10 +++++++++-
> src/PMG/Utils.pm | 10 ++++++++++
> 7 files changed, 49 insertions(+), 7 deletions(-)
>
> diff --git a/src/PMG/RuleDB/ArchiveFilter.pm b/src/PMG/RuleDB/ArchiveFilter.pm
> index 6d91556..3d9890c 100644
> --- a/src/PMG/RuleDB/ArchiveFilter.pm
> +++ b/src/PMG/RuleDB/ArchiveFilter.pm
> @@ -48,6 +48,12 @@ sub parse_entity {
>
> my $res;
>
> + # test regex for validity
> + eval { "" =~ m|$self->{field_value}|; };
> + if (my $err = $@) {
> + warn "invalid regex: $err\n";
> + return $res;
> + }
> # match subtypes? We currently do exact matches only.
>
> if (my $id = $entity->head->mime_attr ('x-proxmox-tmp-aid')) {
> diff --git a/src/PMG/RuleDB/ContentTypeFilter.pm b/src/PMG/RuleDB/ContentTypeFilter.pm
> index 76fc1ce..0199311 100644
> --- a/src/PMG/RuleDB/ContentTypeFilter.pm
> +++ b/src/PMG/RuleDB/ContentTypeFilter.pm
> @@ -60,6 +60,13 @@ sub parse_entity {
>
> my $res;
>
> + # test regex for validity
> + eval { "" =~ m|$self->{field_value}|; };
> + if (my $err = $@) {
> + warn "invalid regex: $err\n";
> + return $res;
> + }
> +
> # match subtypes? We currently do exact matches only.
>
> if (my $id = $entity->head->mime_attr ('x-proxmox-tmp-aid')) {
> diff --git a/src/PMG/RuleDB/MatchArchiveFilename.pm b/src/PMG/RuleDB/MatchArchiveFilename.pm
> index 2ef3543..5b1cb6d 100644
> --- a/src/PMG/RuleDB/MatchArchiveFilename.pm
> +++ b/src/PMG/RuleDB/MatchArchiveFilename.pm
> @@ -25,6 +25,13 @@ sub parse_entity {
>
> my $res;
>
> + # test regex for validity
> + eval { "" =~ m|^$self->{fname}$|i; };
> + if (my $err = $@) {
> + warn "invalid regex: $err\n";
> + return $res;
> + }
> +
> if (my $id = $entity->head->mime_attr('x-proxmox-tmp-aid')) {
> chomp $id;
>
> diff --git a/src/PMG/RuleDB/MatchField.pm b/src/PMG/RuleDB/MatchField.pm
> index 177a283..ee1851a 100644
> --- a/src/PMG/RuleDB/MatchField.pm
> +++ b/src/PMG/RuleDB/MatchField.pm
> @@ -71,9 +71,7 @@ sub save {
>
> my $regex = $self->{field_value};
>
> - # test regex for validity
> - eval { "" =~ /$regex/i; };
> - die "invalid regex: $@\n" if $@;
> + PMG::Utils::test_regex($regex);
>
> my $new_value = "$self->{field}:$regex";
> $new_value =~ s/\\/\\\\/g;
> diff --git a/src/PMG/RuleDB/MatchFilename.pm b/src/PMG/RuleDB/MatchFilename.pm
> index c9cdbe0..90f8654 100644
> --- a/src/PMG/RuleDB/MatchFilename.pm
> +++ b/src/PMG/RuleDB/MatchFilename.pm
> @@ -58,6 +58,9 @@ sub save {
> defined($self->{ogroup}) || die "undefined ogroup: ERROR";
>
> my $new_value = $self->{fname};
> +
> + PMG::Utils::test_regex("^${new_value}\$");
> +
> $new_value =~ s/\\/\\\\/g;
> $new_value = encode('UTF-8', $new_value);
>
> @@ -91,9 +94,12 @@ sub parse_entity {
> chomp $id;
>
> if (my $value = PMG::Utils::extract_filename($entity->head)) {
> - if ($value =~ m|^$self->{fname}$|i) {
> - push @$res, $id;
> - }
> + eval {
> + if ($value =~ m|^$self->{fname}$|i) {
> + push @$res, $id;
> + }
> + };
> + warn "invalid regex: $@\n" if $@;
> }
> }
>
> diff --git a/src/PMG/RuleDB/WhoRegex.pm b/src/PMG/RuleDB/WhoRegex.pm
> index 5c13604..03405bc 100644
> --- a/src/PMG/RuleDB/WhoRegex.pm
> +++ b/src/PMG/RuleDB/WhoRegex.pm
> @@ -60,6 +60,9 @@ sub save {
> defined($self->{address}) || die "undefined address: ERROR";
>
> my $adr = $self->{address};
> +
> + PMG::Utils::test_regex("^${adr}\$");
> +
> $adr =~ s/\\/\\\\/g;
> $adr = encode('UTF-8', $adr);
>
> @@ -100,7 +103,12 @@ sub who_match {
>
> my $t = $self->address;
>
> - return $addr =~ m/^$t$/i;
> + my $res;
> + eval {
> + $res = $addr =~ m/^$t$/i;
> + };
> + warn "invalid regex: $@\n" if $@;
> + return $res;
> }
>
> sub address {
> diff --git a/src/PMG/Utils.pm b/src/PMG/Utils.pm
> index d9c9d2d..da1d81b 100644
> --- a/src/PMG/Utils.pm
> +++ b/src/PMG/Utils.pm
> @@ -1580,4 +1580,14 @@ sub try_decode_utf8 {
> return eval { decode('UTF-8', $data, 1) } // $data;
> }
>
> +sub test_regex {
> + my ($regex) = @_;
> +
> + local $SIG{__WARN__} = sub { die @_ };
> + eval { "" =~ m/$regex/i; };
> + die "invalid regex: $@\n" if $@;
> +
> + return undef;
> +}
> +
> 1;
> --
> 2.39.2
>
>
> _______________________________________________
> pmg-devel mailing list
> pmg-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pmg-devel
>
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-02-14 6:26 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-12-21 12:05 [pmg-devel] [PATCH pmg-api v3] fix #4811: rule db: test regex validity on save Dominik Csapak
2024-02-14 6:26 ` [pmg-devel] applied: " Stoiko Ivanov
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal