From: Amos Jeffries <squid3@treenet.co.nz>
Date: Fri, 30 Dec 2016 06:27:19 +0000 (+1300)
Subject: Detect HTTP header ACL issues
X-Git-Tag: M-staged-PR71~331
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a0b240c;p=thirdparty%2Fsquid.git

Detect HTTP header ACL issues

rep_header and req_header ACL types cannot match multiple different
headers in one test (unlike Squid-2 appears to have done). Produce
an ERROR and ignore the extra line(s) instead of silently changing
all the previous regex to match the second header name.

Also detect and ERROR when header name is missing entirely. Ignore
these lines instead of asserting.
---

diff --git a/src/acl/HttpHeaderData.cc b/src/acl/HttpHeaderData.cc
index 52dbf162bf..ff9275c49c 100644
--- a/src/acl/HttpHeaderData.cc
+++ b/src/acl/HttpHeaderData.cc
@@ -75,9 +75,21 @@ void
 ACLHTTPHeaderData::parse()
 {
     char* t = ConfigParser::strtokFile();
-    assert (t != NULL);
-    hdrName = t;
-    hdrId = Http::HeaderLookupTable.lookup(hdrName).id;
+    if (!t) {
+        debugs(28, DBG_CRITICAL, "ERROR: " << cfg_filename << " line " << config_lineno << ": " << config_input_line);
+        debugs(28, DBG_CRITICAL, "ERROR: Missing header name in ACL");
+        return;
+    }
+
+    if (hdrName.isEmpty()) {
+        hdrName = t;
+        hdrId = Http::HeaderLookupTable.lookup(hdrName).id;
+    } else if (hdrName.caseCmp(t) != 0) {
+        debugs(28, DBG_CRITICAL, "ERROR: " << cfg_filename << " line " << config_lineno << ": " << config_input_line);
+        debugs(28, DBG_CRITICAL, "ERROR: ACL cannot match both " << hdrName << " and " << t << " headers. Use 'anyof' ACL instead.");
+        return;
+    }
+
     regex_rule->parse();
 }