auth: auth-cache - Require cache key to contain at least one variable

diff --git a/src/auth/auth-cache.c b/src/auth/auth-cache.c
index be5693491824c3a5fff81408bc1f160d3f89444e..32959f5d0f4a74f4eb0ab8ee1d6260a6e8357227 100644 (file)
--- a/src/auth/auth-cache.c
+++ b/src/auth/auth-cache.c
@@ -86,6 +86,13 @@ static int auth_cache_parse_key_exclude(pool_t pool, const char *query,
        const char *const *vars = var_expand_program_variables(prog);
        str = t_str_new(32);
 
+       if (*vars == NULL && *query != '\0') {
+               var_expand_program_free(&prog);
+               *error_r = t_strdup_printf("%s: Cache key must contain at least one variable",
+                                          query);
+               return -1;
+       }
+
        for (; *vars != NULL; vars++) {
                /* ignore any providers */
                if (strchr(*vars, ':') != NULL &&

diff --git a/src/auth/test-auth-cache.c b/src/auth/test-auth-cache.c
index 46836defc6de0cadef3f9919a14b9a15196fe640..b36d83ec022969de5268fca3633c0a4b33b179b6 100644 (file)
--- a/src/auth/test-auth-cache.c
+++ b/src/auth/test-auth-cache.c
@@ -97,7 +97,35 @@ static void test_auth_cache_parse_key(void)
                                                 tests[i].in);
                test_assert_strcmp_idx(cache_key, tests[i].out, i);
        }
+
+       test_end();
+}
+
+static enum fatal_test_state test_cache_key_missing_variable(unsigned int i)
+{
+       if (i == 0)
+               test_begin("auth cache missing variable");
+
+       /* ensure that we do not accept static string */
+       static const struct {
+               const char *in, *out;
+       } tests_bad[] = {
+               { "%u", "auth-cache: %u: Cache key must contain at least one variable" },
+               { "foobar", "auth-cache: foobar: Cache key must contain at least one variable" },
+               { "%{test", "auth-cache: var_expand_program_create(%{test) " \
+                           "failed: syntax error, unexpected end of file, " \
+                           "expecting CCBRACE or PIPE" },
+       };
+
+       if (i < N_ELEMENTS(tests_bad)) {
+               test_expect_fatal_string(tests_bad[i].out);
+               (void)auth_cache_parse_key(pool_datastack_create(),
+                                          tests_bad[i].in);
+               return FATAL_TEST_FAILURE;
+       }
+
        test_end();
+       return FATAL_TEST_FINISHED;
 }
 
 int main(void)
@@ -108,7 +136,14 @@ int main(void)
                test_auth_cache_parse_key,
                NULL
        };
-       int ret = test_run(test_functions);
+
+       static test_fatal_func_t *const fatal_functions[] = {
+               test_cache_key_missing_variable,
+               NULL,
+       };
+
+       int ret = test_run_with_fatals(test_functions, fatal_functions);
+
        event_unref(&auth_event);
        return ret;
 }