Skip to content

Commit 1a7c634

Browse files
authored
Refine regex pattern for domain path matching
Updated regex pattern to escape only the '/' character while noting potential risks with the wildcard '.' character.
1 parent 274c5f7 commit 1a7c634

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

server/src/main/java/com/cloud/user/DomainManagerImpl.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1074,7 +1074,7 @@ protected void validateNewParentDomainCanAccessResourcesOfDomainToBeMoved(String
10741074
for (Map.Entry<Long, List<String>> entry : idsOfDomainsWithResourcesUsedByDomainToBeMoved.entrySet()) {
10751075
DomainVO domainWithResourceUsedByDomainToBeMoved = _domainDao.findById(entry.getKey());
10761076

1077-
Pattern pattern = Pattern.compile(domainWithResourceUsedByDomainToBeMoved.getPath().replace("/", "\\/").concat(".*"));
1077+
Pattern pattern = Pattern.compile(domainWithResourceUsedByDomainToBeMoved.getPath().replace("/", "\\/").concat(".*")); // This only scaped one Regex metacharacter (/). The wildcard `.` is more common and dangerous in my opinion.
10781078
Matcher matcher = pattern.matcher(newPathOfDomainToBeMoved);
10791079
if (!matcher.matches()) {
10801080
domainsOfResourcesInaccessibleToNewParentDomain.put(domainWithResourceUsedByDomainToBeMoved, entry.getValue());

0 commit comments

Comments
 (0)