Repository navigation
glob: anchor the "**/" tail to a path-segment boundary - #42
Merged
Merged
Conversation
glob_match("**/shadow", "bin/login.shadow") returned true. The "**/" branch
collapsed the "**", consumed the "/", then retried the tail at every character
offset, so the tail matched mid-segment. Every builtin path rule with a literal
final segment inherited this: an ELF binary named login.shadow was reported as a
shadow-file (credential store), dbus-wpa_supplicant.conf as a wifi-config, and
so on.
Match the documented contract ("**" crosses segments; the literal tail is a
whole segment) by restarting the tail only at the root or just after a "/".
"**/shadow" still matches shadow, a/shadow and a/b/shadow, but no longer the
shadow tail of a/login.shadow. Add negative unit cases.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
glob_match("**/shadow", "bin/login.shadow")returnstrue. The**/branch ingm()collapses the**, consumes the/, then retries the remaining pattern at every character offset, so the tail can match in the middle of a segment.Every builtin path rule with a literal final segment inherits this. An ELF binary named
login.shadowis reported as ashadow-file("Password hash database"),dbus-wpa_supplicant.confas awifi-config, and so on, so a directory holding several such files yields a cluster of bogus credential findings alongside the one genuineshadow.Fix
The documented contract is that
**crosses segments and the literal tail is a whole final segment. Restart the tail match only at the root or immediately after a/.**/shadowstill matchesshadow,a/shadowanda/b/shadow, but no longer theshadowtail ofa/login.shadow.Tests
New negative unit cases in
tests/unit/unit_tests.cpp(bin/login.shadow,login.shadow,notid_rsa,myhtpasswdall rejected) plus a**/shadow->var/config/shadowpositive. Full suite green:mithril_unit(1451 checks) andtests/run.shall passed.