From 246808bc33a2343827ab2b4d76ae449fcc549ac9 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Fri, 20 Nov 2020 12:22:44 +0100
Subject: tunnel: T3072: xml: harden regex validators

---
 interface-definitions/interfaces-tunnel.xml.in | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

(limited to 'interface-definitions')

diff --git a/interface-definitions/interfaces-tunnel.xml.in b/interface-definitions/interfaces-tunnel.xml.in
index bf588a075..b322374b3 100644
--- a/interface-definitions/interfaces-tunnel.xml.in
+++ b/interface-definitions/interfaces-tunnel.xml.in
@@ -39,7 +39,6 @@
                 <script>${vyos_completion_dir}/list_local.py</script>
               </completionHelp>
               <constraint>
-                <!-- does it need fixing/changing to be more restrictive ? -->
                 <validator name="ip-address"/>
               </constraint>
             </properties>
@@ -104,7 +103,7 @@
                 <script>${vyos_completion_dir}/list_interfaces.py</script>
               </completionHelp>
               <constraint>
-                <regex>(en|eth|br|bond|gnv|vxlan|wg|tun)[0-9]+</regex>
+                <regex>^(en|eth|br|bond|gnv|vxlan|wg|tun)[0-9]+$</regex>
               </constraint>
             </properties>
           </leafNode>
@@ -145,7 +144,7 @@
               <constraint>
                 <regex>^(gre|gre-bridge|ip6gre|ip6ip6|ipip|ipip6|sit)$</regex>
               </constraint>
-              <constraintErrorMessage>Invalid encapsulation mode, must be one of: gre gre-bridge ip6gre ip6ip6 ipip ipip6 sit</constraintErrorMessage>
+              <constraintErrorMessage>Invalid encapsulation, must be one of: gre, gre-bridge, ipip, sit, ipip6, ip6ip6, ip6gre</constraintErrorMessage>
             </properties>
           </leafNode>
           <leafNode name="multicast">
@@ -163,7 +162,7 @@
                 <description>Disable Multicast (default)</description>
               </valueHelp>
               <constraint>
-                <regex>(enable|disable)</regex>
+                <regex>^(enable|disable)$</regex>
               </constraint>
               <constraintErrorMessage>Must be 'disable' or 'enable'</constraintErrorMessage>
             </properties>
-- 
cgit v1.2.3