|
| 1 | +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> |
| 2 | +<HTML> |
| 3 | + <HEAD> |
| 4 | + <TITLE> [squid-dev] Issue with acl note (without -m) splitting helper tokens containing commas |
| 5 | + </TITLE> |
| 6 | + <LINK REL="Index" HREF="index.html" > |
| 7 | + <LINK REL="made" HREF="mailto:squid-dev%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-dev%5D%20Issue%20with%20acl%20note%20%28without%20-m%29%20splitting%20helper%0A%20tokens%20containing%20commas&In-Reply-To=%3CCADJd0Y1M%3DZ9VY6spPMcR1SoFgrfDKuWdbWM%3D6%3DA%3DCEoS%2Boi%2BOg%40mail.gmail.com%3E"> |
| 8 | + <META NAME="robots" CONTENT="index,nofollow"> |
| 9 | + <style type="text/css"> |
| 10 | + pre { |
| 11 | + white-space: pre-wrap; /* css-2.1, curent FF, Opera, Safari */ |
| 12 | + } |
| 13 | + </style> |
| 14 | + <META http-equiv="Content-Type" content="text/html; charset=us-ascii"> |
| 15 | + <LINK REL="Previous" HREF="010015.html"> |
| 16 | + |
| 17 | + </HEAD> |
| 18 | + <BODY BGCOLOR="#ffffff"> |
| 19 | + <H1>[squid-dev] Issue with acl note (without -m) splitting helper tokens containing commas</H1> |
| 20 | + <B>Andrey K</B> |
| 21 | + <A HREF="mailto:squid-dev%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-dev%5D%20Issue%20with%20acl%20note%20%28without%20-m%29%20splitting%20helper%0A%20tokens%20containing%20commas&In-Reply-To=%3CCADJd0Y1M%3DZ9VY6spPMcR1SoFgrfDKuWdbWM%3D6%3DA%3DCEoS%2Boi%2BOg%40mail.gmail.com%3E" |
| 22 | + TITLE="[squid-dev] Issue with acl note (without -m) splitting helper tokens containing commas">ankor2023 at gmail.com |
| 23 | + </A><BR> |
| 24 | + <I>Fri Apr 17 13:08:49 UTC 2026</I> |
| 25 | + <P><UL> |
| 26 | + <LI>Previous message (by thread): <A HREF="010015.html">[squid-dev] form PROXY header for cache_peer requests |
| 27 | +</A></li> |
| 28 | + |
| 29 | + <LI> <B>Messages sorted by:</B> |
| 30 | + <a href="date.html#10017">[ date ]</a> |
| 31 | + <a href="thread.html#10017">[ thread ]</a> |
| 32 | + <a href="subject.html#10017">[ subject ]</a> |
| 33 | + <a href="author.html#10017">[ author ]</a> |
| 34 | + </LI> |
| 35 | + </UL> |
| 36 | + <HR> |
| 37 | +<!--beginarticle--> |
| 38 | +<PRE>Hello, |
| 39 | + |
| 40 | +While working with annotations, I’ve noticed an inconsistency in how acl |
| 41 | +note (without the -m option) handles tokens received from helpers when they |
| 42 | +contain a comma. |
| 43 | + |
| 44 | +According to the documentation, an ACL like this: |
| 45 | + acl staff note group Staff:accountants,lawyers,security |
| 46 | +should match a helper response such as: |
| 47 | + group="Staff:accountants,lawyers,security" |
| 48 | + |
| 49 | +However, this is not the case. The helper's response is split into tokens |
| 50 | +using a comma as the default delimiter. As a result, only ACLs like the |
| 51 | +following will match: |
| 52 | + acl staff note group lawyers |
| 53 | + |
| 54 | +This behavior occurs because in Acl::NoteCheck::matchNotes(), a comma is |
| 55 | +passed as the default delimiter to the expandListEntries() function: |
| 56 | + bool |
| 57 | + ACLNoteStrategy::matchNotes(ACLData<MatchType> *noteData, const |
| 58 | +NotePairs *note) const |
| 59 | + { |
| 60 | + const NotePairs::Entries &entries = |
| 61 | +note->expandListEntries(&delimiters.value); |
| 62 | + for (auto e: entries) |
| 63 | + if (noteData->match(e.getRaw())) |
| 64 | + return true; |
| 65 | + return false; |
| 66 | + } |
| 67 | + |
| 68 | +After reviewing the source code, I found that the comma is added in |
| 69 | +src/acl/Note.h within the AnnotationCheck class constructor: |
| 70 | + AnnotationCheck(): delimiters(CharacterSet("__FILE__", ",")) {} |
| 71 | + |
| 72 | +Using a comma as the default delimiter makes it difficult to validate full |
| 73 | +tokens that may naturally contain commas. |
| 74 | + |
| 75 | +I would like to propose two changes: |
| 76 | +1. Removing the default comma delimiter. |
| 77 | +I am prepared to submit a simple PR to exclude this comma to fix the |
| 78 | +incorrect matching of strings containing commas. |
| 79 | +However, I realize this might be a breaking change for users who currently |
| 80 | +rely on this implicit splitting behavior. |
| 81 | + |
| 82 | +2. Supporting custom delimiters in helper responses. |
| 83 | +I also propose a PR to support a format where tag values can be passed as a |
| 84 | +list with a custom delimiter: |
| 85 | + <key>=<delimiter>"<value1><delimiter><value2>..." |
| 86 | +For example: |
| 87 | + group=,"group1,group2,group3" |
| 88 | + clt_con_tag=;"tag1;tag2;tag3" |
| 89 | +In this PR, the helper response would be tokenized based on the specified |
| 90 | +custom delimiter, while still supporting delimiter escaping with a |
| 91 | +backslash (\). |
| 92 | +In this scenario, having a hardcoded comma as the default delimiter in |
| 93 | +the AnnotationCheck |
| 94 | +class would also create complications. |
| 95 | + |
| 96 | +I would appreciate your thoughts on these proposals and whether they align |
| 97 | +with the project's roadmap. |
| 98 | + |
| 99 | +Kind regards, |
| 100 | + Ankor. |
| 101 | +-------------- next part -------------- |
| 102 | +An HTML attachment was scrubbed... |
| 103 | +URL: <<A HREF="http://lists.squid-cache.org/pipermail/squid-dev/attachments/20260417/7fab43b9/attachment.htm">http://lists.squid-cache.org/pipermail/squid-dev/attachments/20260417/7fab43b9/attachment.htm</A>> |
| 104 | +</PRE> |
| 105 | + |
| 106 | +<!--endarticle--> |
| 107 | + <HR> |
| 108 | + <P><UL> |
| 109 | + <!--threads--> |
| 110 | + <LI>Previous message (by thread): <A HREF="010015.html">[squid-dev] form PROXY header for cache_peer requests |
| 111 | +</A></li> |
| 112 | + |
| 113 | + <LI> <B>Messages sorted by:</B> |
| 114 | + <a href="date.html#10017">[ date ]</a> |
| 115 | + <a href="thread.html#10017">[ thread ]</a> |
| 116 | + <a href="subject.html#10017">[ subject ]</a> |
| 117 | + <a href="author.html#10017">[ author ]</a> |
| 118 | + </LI> |
| 119 | + </UL> |
| 120 | + |
| 121 | +<hr> |
| 122 | +<a href="https://lists.squid-cache.org/listinfo/squid-dev">More information about the squid-dev |
| 123 | +mailing list</a><br> |
| 124 | +</body></html> |
0 commit comments