]> git.ipfire.org Git - thirdparty/rspamd.git/commit
[Fix] maps: anchor glob map patterns to match the whole subject
authorVsevolod Stakhov <vsevolod@rspamd.com>
Wed, 8 Jul 2026 08:52:53 +0000 (09:52 +0100)
committerVsevolod Stakhov <vsevolod@rspamd.com>
Wed, 8 Jul 2026 08:53:34 +0000 (09:53 +0100)
commit06cf98f2f5e9ff13141a7ccf6498ac4e4d53cb46
tree4ba15c31425ab3088df3e9e11cc243ad9ecbc8ae
parent128032ed04bb0519dc90d5f64d602e592e65364d
[Fix] maps: anchor glob map patterns to match the whole subject

Glob map entries were compiled into unanchored regexps and matched
with substring search semantics, so a `t.co` entry matched
`walmart.com` and `*.bit.ly` matched `foo.bit.ly.evil.com`.
Wrap the translated pattern into `^(?:...)$` at map load time so
glob entries match the subject as a whole: bare names match exactly,
wildcards match only what they say.

This affects all glob maps: multimap glob/glob_multi, url_redirector
redirector_hosts_map, dkim_signing/arc signing_table and key_table,
mx_check exclusions and the rbl glob returncodes matcher. Maps that
relied on the accidental substring behaviour must now use explicit
wildcards.

Fixes #6125
src/libserver/maps/map_helpers.c
test/functional/cases/001_merged/102_multimap.robot
test/functional/configs/maps/glob.list [new file with mode: 0644]
test/functional/configs/merged-override.conf