From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id C640C91309 for ; Wed, 14 Feb 2024 07:26:27 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 9E5E63EA0E for ; Wed, 14 Feb 2024 07:26:27 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Wed, 14 Feb 2024 07:26:26 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id D704348094 for ; Wed, 14 Feb 2024 07:26:25 +0100 (CET) Date: Wed, 14 Feb 2024 07:26:23 +0100 From: Stoiko Ivanov To: Dominik Csapak Cc: pmg-devel@lists.proxmox.com Message-ID: References: <20231221120508.77186-1-d.csapak@proxmox.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20231221120508.77186-1-d.csapak@proxmox.com> X-SPAM-LEVEL: Spam detection results: 0 AWL 0.086 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record T_SCC_BODY_TEXT_LINE -0.01 - Subject: [pmg-devel] applied: [PATCH pmg-api v3] fix #4811: rule db: test regex validity on save X-BeenThere: pmg-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Mail Gateway development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Feb 2024 06:26:27 -0000 Thanks for the rework - works really nice now! applied with a small comment inserted in test_regex giving 2 examples of regex causing warn and die respectively a patch-version changelog would have helped me a bit (then again reviewing the third version earlier would have done so as well). On Thu, Dec 21, 2023 at 01:05:08PM +0100, Dominik Csapak wrote: > and warn only when it's an invalid regex on execution, because users may > have previously had such rules. Otherwise, pmg-smtp-filter will restart > every time it encounters such a rule. > > When testing, 'die' if the regex execution 'warns', so that users cannot > enter a semi-invalid or very wrong regex like '^*foo$'. > > do so for every rule type that uses a regex to match > > Signed-off-by: Dominik Csapak > --- > src/PMG/RuleDB/ArchiveFilter.pm | 6 ++++++ > src/PMG/RuleDB/ContentTypeFilter.pm | 7 +++++++ > src/PMG/RuleDB/MatchArchiveFilename.pm | 7 +++++++ > src/PMG/RuleDB/MatchField.pm | 4 +--- > src/PMG/RuleDB/MatchFilename.pm | 12 +++++++++--- > src/PMG/RuleDB/WhoRegex.pm | 10 +++++++++- > src/PMG/Utils.pm | 10 ++++++++++ > 7 files changed, 49 insertions(+), 7 deletions(-) > > diff --git a/src/PMG/RuleDB/ArchiveFilter.pm b/src/PMG/RuleDB/ArchiveFilter.pm > index 6d91556..3d9890c 100644 > --- a/src/PMG/RuleDB/ArchiveFilter.pm > +++ b/src/PMG/RuleDB/ArchiveFilter.pm > @@ -48,6 +48,12 @@ sub parse_entity { > > my $res; > > + # test regex for validity > + eval { "" =~ m|$self->{field_value}|; }; > + if (my $err = $@) { > + warn "invalid regex: $err\n"; > + return $res; > + } > # match subtypes? We currently do exact matches only. > > if (my $id = $entity->head->mime_attr ('x-proxmox-tmp-aid')) { > diff --git a/src/PMG/RuleDB/ContentTypeFilter.pm b/src/PMG/RuleDB/ContentTypeFilter.pm > index 76fc1ce..0199311 100644 > --- a/src/PMG/RuleDB/ContentTypeFilter.pm > +++ b/src/PMG/RuleDB/ContentTypeFilter.pm > @@ -60,6 +60,13 @@ sub parse_entity { > > my $res; > > + # test regex for validity > + eval { "" =~ m|$self->{field_value}|; }; > + if (my $err = $@) { > + warn "invalid regex: $err\n"; > + return $res; > + } > + > # match subtypes? We currently do exact matches only. > > if (my $id = $entity->head->mime_attr ('x-proxmox-tmp-aid')) { > diff --git a/src/PMG/RuleDB/MatchArchiveFilename.pm b/src/PMG/RuleDB/MatchArchiveFilename.pm > index 2ef3543..5b1cb6d 100644 > --- a/src/PMG/RuleDB/MatchArchiveFilename.pm > +++ b/src/PMG/RuleDB/MatchArchiveFilename.pm > @@ -25,6 +25,13 @@ sub parse_entity { > > my $res; > > + # test regex for validity > + eval { "" =~ m|^$self->{fname}$|i; }; > + if (my $err = $@) { > + warn "invalid regex: $err\n"; > + return $res; > + } > + > if (my $id = $entity->head->mime_attr('x-proxmox-tmp-aid')) { > chomp $id; > > diff --git a/src/PMG/RuleDB/MatchField.pm b/src/PMG/RuleDB/MatchField.pm > index 177a283..ee1851a 100644 > --- a/src/PMG/RuleDB/MatchField.pm > +++ b/src/PMG/RuleDB/MatchField.pm > @@ -71,9 +71,7 @@ sub save { > > my $regex = $self->{field_value}; > > - # test regex for validity > - eval { "" =~ /$regex/i; }; > - die "invalid regex: $@\n" if $@; > + PMG::Utils::test_regex($regex); > > my $new_value = "$self->{field}:$regex"; > $new_value =~ s/\\/\\\\/g; > diff --git a/src/PMG/RuleDB/MatchFilename.pm b/src/PMG/RuleDB/MatchFilename.pm > index c9cdbe0..90f8654 100644 > --- a/src/PMG/RuleDB/MatchFilename.pm > +++ b/src/PMG/RuleDB/MatchFilename.pm > @@ -58,6 +58,9 @@ sub save { > defined($self->{ogroup}) || die "undefined ogroup: ERROR"; > > my $new_value = $self->{fname}; > + > + PMG::Utils::test_regex("^${new_value}\$"); > + > $new_value =~ s/\\/\\\\/g; > $new_value = encode('UTF-8', $new_value); > > @@ -91,9 +94,12 @@ sub parse_entity { > chomp $id; > > if (my $value = PMG::Utils::extract_filename($entity->head)) { > - if ($value =~ m|^$self->{fname}$|i) { > - push @$res, $id; > - } > + eval { > + if ($value =~ m|^$self->{fname}$|i) { > + push @$res, $id; > + } > + }; > + warn "invalid regex: $@\n" if $@; > } > } > > diff --git a/src/PMG/RuleDB/WhoRegex.pm b/src/PMG/RuleDB/WhoRegex.pm > index 5c13604..03405bc 100644 > --- a/src/PMG/RuleDB/WhoRegex.pm > +++ b/src/PMG/RuleDB/WhoRegex.pm > @@ -60,6 +60,9 @@ sub save { > defined($self->{address}) || die "undefined address: ERROR"; > > my $adr = $self->{address}; > + > + PMG::Utils::test_regex("^${adr}\$"); > + > $adr =~ s/\\/\\\\/g; > $adr = encode('UTF-8', $adr); > > @@ -100,7 +103,12 @@ sub who_match { > > my $t = $self->address; > > - return $addr =~ m/^$t$/i; > + my $res; > + eval { > + $res = $addr =~ m/^$t$/i; > + }; > + warn "invalid regex: $@\n" if $@; > + return $res; > } > > sub address { > diff --git a/src/PMG/Utils.pm b/src/PMG/Utils.pm > index d9c9d2d..da1d81b 100644 > --- a/src/PMG/Utils.pm > +++ b/src/PMG/Utils.pm > @@ -1580,4 +1580,14 @@ sub try_decode_utf8 { > return eval { decode('UTF-8', $data, 1) } // $data; > } > > +sub test_regex { > + my ($regex) = @_; > + > + local $SIG{__WARN__} = sub { die @_ }; > + eval { "" =~ m/$regex/i; }; > + die "invalid regex: $@\n" if $@; > + > + return undef; > +} > + > 1; > -- > 2.39.2 > > > _______________________________________________ > pmg-devel mailing list > pmg-devel@lists.proxmox.com > https://lists.proxmox.com/cgi-bin/mailman/listinfo/pmg-devel > >