Make regex matching policy key stricter

There is a bug where this regex can match multiple lines if a policy
contains ':'.

Make this regex stricter by making sure the key doesn't end with a ':'
within the quotes.

Closes-Bug: #1968294

Change-Id: I4090d6831db8ddc4fba294f181085b657e2b3345
(cherry picked from commit 33fb90326f)
(cherry picked from commit 9e10e80160)
(cherry picked from commit 81ea071166)
This commit is contained in:
Jake Yip 2022-04-08 18:42:20 +10:00 committed by Takashi Kajinami
parent 9072278b84
commit 358e2a4aa0
3 changed files with 18 additions and 4 deletions

View File

@ -101,7 +101,7 @@ define openstacklib::policy::base (
file_line { "${file_path}-${key}" :
path => $file_path,
line => "'${key}': '${value_real}'",
match => "^['\"]?${key}['\"]?\\s*:.+"
match => "^['\"]?${key}(?!:)['\"]?\\s*:.+"
}
File<| title == $file_path |>
-> File_line<| title == "${file_path}-${key}" |>

View File

@ -18,6 +18,18 @@ describe 'policy file management' do
value => 'role:member',
file_format => 'yaml',
}
openstacklib::policy::base { 'get_router':
file_path => '/tmp/policy.yaml',
key => 'get_router',
value => 'rule:admin_or_owner',
file_format => 'yaml',
}
openstacklib::policy::base { 'get_router:distributed':
file_path => '/tmp/policy.yaml',
key => 'get_router:distributed',
value => 'rule:admin_only',
file_format => 'yaml',
}
EOS
@ -30,6 +42,8 @@ describe 'policy file management' do
it { should exist }
it { should contain("'is_admin': 'role:admin'") }
it { should contain("'is_member': 'role:member'") }
it { should contain("'get_router': 'rule:admin_or_owner'") }
it { should contain("'get_router:distributed': 'rule:admin_only'") }
end
end

View File

@ -68,7 +68,7 @@ describe 'openstacklib::policy::base' do
it { should contain_file_line('/etc/nova/policy.yaml-context_is_admin or owner').with(
:path => '/etc/nova/policy.yaml',
:line => '\'context_is_admin or owner\': \'foo:bar\'',
:match => '^[\'"]?context_is_admin or owner[\'"]?\s*:.+'
:match => '^[\'"]?context_is_admin or owner(?!:)[\'"]?\s*:.+'
) }
context 'with single-quotes in value' do
@ -81,7 +81,7 @@ describe 'openstacklib::policy::base' do
it { should contain_file_line('/etc/nova/policy.yaml-context_is_admin or owner').with(
:path => '/etc/nova/policy.yaml',
:line => '\'context_is_admin or owner\': \'foo:\'\'bar\'\'\'',
:match => '^[\'"]?context_is_admin or owner[\'"]?\s*:.+'
:match => '^[\'"]?context_is_admin or owner(?!:)[\'"]?\s*:.+'
) }
end
@ -95,7 +95,7 @@ describe 'openstacklib::policy::base' do
it { should contain_file_line('/etc/nova/policy.yaml-context_is_admin or owner').with(
:path => '/etc/nova/policy.yaml',
:line => '\'context_is_admin or owner\': \'foo:\'\'bar\'\'\'',
:match => '^[\'"]?context_is_admin or owner[\'"]?\s*:.+'
:match => '^[\'"]?context_is_admin or owner(?!:)[\'"]?\s*:.+'
) }
end
end