[PATCH proxmox v5 19/42] notify: matcher: ensure that field names match SAFE_ID_REGEX

[Lukas Wagner <l.wagner@proxmox.com>]

The old 'match-field' options used their schema to validate the name, so
it also makes sense to add additional checks for the JSON-based
expression variant.

Suggested-by: Michael Köppl <m.koeppl@proxmox.com>
Signed-off-by: Lukas Wagner <l.wagner@proxmox.com>
---

Notes:
    New in v5

 proxmox-notify/src/matcher/field.rs | 25 ++++++++++++----
 proxmox-notify/src/matcher/mod.rs   | 45 +++++++++++++++++++++++++++++
 2 files changed, 65 insertions(+), 5 deletions(-)

diff --git a/proxmox-notify/src/matcher/field.rs b/proxmox-notify/src/matcher/field.rs
index cd23ff9c..ac7da37d 100644
--- a/proxmox-notify/src/matcher/field.rs
+++ b/proxmox-notify/src/matcher/field.rs
@@ -1,3 +1,4 @@
+use proxmox_schema::api_types::SAFE_ID_REGEX;
 use regex::Regex;
 use serde::{Deserialize, Serialize};
 
@@ -55,11 +56,25 @@ impl MatchDirective for FieldMatcher {
     }
 
     fn validate(&self) -> Result<(), Error> {
-        if let FieldMatcher::Exact { values, .. } = self {
-            if values.is_empty() {
-                return Err(Error::Generic(
-                    "field matcher must contain values to match".to_string(),
-                ));
+        match self {
+            FieldMatcher::Exact { field, values } => {
+                if values.is_empty() {
+                    return Err(Error::Generic(
+                        "field matcher must contain values to match".to_string(),
+                    ));
+                }
+                if !SAFE_ID_REGEX.is_match(field) {
+                    return Err(Error::Generic(
+                        "field name does not match regex pattern".to_string(),
+                    ));
+                }
+            }
+            FieldMatcher::Regex { field, .. } => {
+                if !SAFE_ID_REGEX.is_match(field) {
+                    return Err(Error::Generic(
+                        "field name does not match regex pattern".to_string(),
+                    ));
+                }
             }
         }
 
diff --git a/proxmox-notify/src/matcher/mod.rs b/proxmox-notify/src/matcher/mod.rs
index a3b97952..c74e3f28 100644
--- a/proxmox-notify/src/matcher/mod.rs
+++ b/proxmox-notify/src/matcher/mod.rs
@@ -534,4 +534,49 @@ mod tests {
             assert!(config.ensure_valid().is_err());
         }
     }
+
+    #[test]
+    fn test_invalid_fields() {
+        let exact_field_matcher_template = r#"
+            {
+              "match": {
+                "type": "field",
+                "field": "%FIELD%",
+                "values": ["abc"]
+              }
+            }"#;
+
+        let regex_field_matcher_template = r#"
+            {
+              "match": {
+                "type": "field",
+                "field": "%FIELD%",
+                "regex": "abc"
+              }
+            }"#;
+
+        for (field, valid) in [
+            ("some-field", true),
+            ("some_field", true),
+            ("some-", true),
+            ("some.field", true),
+            ("-some", false),
+            ("some%field", false),
+            ("", false),
+        ] {
+            for tpl in [exact_field_matcher_template, regex_field_matcher_template] {
+                let mut config = MatcherConfig {
+                    name: "matcher".to_string(),
+                    expression: Some(tpl.replace("%FIELD%", field)),
+                    ..Default::default()
+                };
+
+                assert_eq!(
+                    config.ensure_valid().is_ok(),
+                    valid,
+                    "{field} should be {valid}"
+                );
+            }
+        }
+    }
 }
-- 
2.47.3