Repository navigation
Conversation
Path, header, and query param regex matches use `Regex::find` and then require the match to span the whole value. `find` returns the leftmost-first match, so a pattern like `/admin|/admin/.*` stops at `/admin` and never matches `/admin/users`, and lazy repetitions stop at the shortest match. The route is then skipped and the request is handled by a less specific route, which may carry a different authorization policy. Compile regexes received from the policy API as `^(?:re)$` so the search only considers matches of the entire value. The raw pattern is parsed first so that wrapping cannot make an invalid pattern valid. Signed-off-by: danish bhat <danish@medios.digiscrypt.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Regex route matches miss values that the whole pattern matches
MatchPath,MatchHeaderandMatchQueryParamcheck regexes withRegex::findand then require the match to cover the entire value.finduses leftmost-first semantics, so with/admin|/admin/.*it returns/adminfor/admin/usersand the route is rejected, even though the pattern fully matches the path. Lazy repetitions (/foo/.+?) fail the same way. The policy controller passes the Gateway API regex through unanchored, so the request is then served by whichever less specific route matches. In inbound policy that route can have a looser authorization, for example a catch-all/route next to a restricted admin route.Repro, with routes
[Prefix("/") -> catch-all, Regex("/admin|/admin/.*") -> admin]andGET /admin/users,http::findselects the catch-all route onmainand the admin route with this change. Regexes from the policy API are now compiled as^(?:re)$after the raw pattern is validated on its own, so a pattern like/foo)|(/baris still rejected. Regression tests for the path, header and query param conversions fail onmainand pass here.