From 3f407aa8d66dacbbf92e22673d8871e429079ce0 Mon Sep 17 00:00:00 2001
From: John Estabrook <jestabro@vyos.io>
Date: Mon, 5 Sep 2022 06:17:48 -0500
Subject: cstore: T4664: add validation: no whitespace in tag node value names

---
 src/cstore/cstore.cpp | 22 ++++++++++++++++++++++
 src/cstore/cstore.hpp |  4 ++++
 2 files changed, 26 insertions(+)

(limited to 'src/cstore')

diff --git a/src/cstore/cstore.cpp b/src/cstore/cstore.cpp
index 71d30d1..b9f68a2 100644
--- a/src/cstore/cstore.cpp
+++ b/src/cstore/cstore.cpp
@@ -18,6 +18,7 @@
 #include <cstdlib>
 #include <cstring>
 #include <cstdarg>
+#include <ctype.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
@@ -108,6 +109,21 @@ Cstore::createCstore(bool use_edit_level)
   return (new unionfs::UnionfsCstore(use_edit_level));
 }
 
+// utility function
+bool
+Cstore::contains_whitespace(const char *name) {
+  int i = 0;
+  char c;
+  while (name[i]) {
+    c = name[i];
+    if (isspace(c)) return true;
+    i++;
+  }
+
+  return false;
+}
+// end utility function
+
 // for "specific session" (see UnionfsCstore constructor for details)
 Cstore *
 Cstore::createCstore(const string& session_id, string& env)
@@ -337,6 +353,7 @@ Cstore::validateSetPath(const Cpath& path_comps)
 {
   ASSERT_IN_SESSION;
 
+  Cpath *pcomps = const_cast<Cpath *>(&path_comps);
   // if we can get parsed tmpl, path is valid
   string terr;
   tr1::shared_ptr<Ctemplate> def(get_parsed_tmpl(path_comps, true, terr));
@@ -350,6 +367,11 @@ Cstore::validateSetPath(const Cpath& path_comps)
   #else
   unique_ptr<SavePaths> save(create_save_paths());
   #endif
+  if (def->isTag() && contains_whitespace((*pcomps)[pcomps->size() - 1])) {
+    string output = "Tag node value name must not contain whitespace\n";
+    output_user(output.c_str());
+    return false;
+  }
   if (!def->isValue()) {
     if (!def->isTypeless()) {
       /* disallow setting value node without value
diff --git a/src/cstore/cstore.hpp b/src/cstore/cstore.hpp
index 53d9c53..db37d26 100644
--- a/src/cstore/cstore.hpp
+++ b/src/cstore/cstore.hpp
@@ -444,6 +444,10 @@ private:
   };
   // end path modifiers
 
+  // utility function
+  bool contains_whitespace(const char *name);
+  // end utility function
+
   // these require full path
   // (note: get_parsed_tmpl also uses current tmpl path)
   tr1::shared_ptr<Ctemplate> get_parsed_tmpl(const Cpath& path_comps,
-- 
cgit v1.2.3