From: Alan T. DeKok <aland@freeradius.org>
Date: Wed, 18 Oct 2023 20:29:46 +0000 (-0400)
Subject: don't return grouped data
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1db39f990615defad5df7a831fa8a7db42a62852;p=thirdparty%2Ffreeradius-server.git

don't return grouped data

the arguments to the function are grouped.  But the actual content
of the arguments is the group contents.  It's not the group.

So we can't copy the input groups to the output, that results in
too many groups.
---

diff --git a/src/lib/unlang/xlat_builtin.c b/src/lib/unlang/xlat_builtin.c
index 8509b580ea0..48f2b0d1e6a 100644
--- a/src/lib/unlang/xlat_builtin.c
+++ b/src/lib/unlang/xlat_builtin.c
@@ -755,9 +755,16 @@ static xlat_action_t xlat_func_taint(UNUSED TALLOC_CTX *ctx, fr_dcursor_t *out,
 {
 	fr_value_box_t *vb;
 
-	fr_value_box_list_taint(in);
 	while ((vb = fr_value_box_list_pop_head(in)) != NULL) {
-		fr_dcursor_append(out, vb);
+		fr_value_box_t *child;
+
+		fr_assert(vb->type == FR_TYPE_GROUP);
+
+		while ((child = fr_value_box_list_pop_head(&vb->vb_group)) != NULL) {
+			child->tainted = true;
+
+			fr_dcursor_append(out, child);
+		}
 	}
 
 	return XLAT_ACTION_DONE;