From: Alan T. DeKok <aland@freeradius.org>
Date: Tue, 12 Jan 2021 13:13:27 +0000 (-0500)
Subject: forbid list / regex for switch / case
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=de8f66dc3b75d4a2c86e98d5d374880285d15d86;p=thirdparty%2Ffreeradius-server.git

forbid list / regex for switch / case

we can _probably_ allow regexes for case, but that requires
additional changes to switch.c.  The condition created there
must satisfy the requirements of the run-time evaluator
---

diff --git a/src/lib/unlang/compile.c b/src/lib/unlang/compile.c
index 492451ce763..273f59cdea3 100644
--- a/src/lib/unlang/compile.c
+++ b/src/lib/unlang/compile.c
@@ -1953,6 +1953,18 @@ static unlang_t *compile_switch(UNUSED unlang_t *parent, unlang_compile_t *unlan
 		return NULL;
 	}
 
+	if (tmpl_is_list(gext->vpt)) {
+		cf_log_err(cs, "Cannot use list for 'switch' statement");
+		talloc_free(g);
+		return NULL;
+	}
+
+	if (tmpl_contains_regex(gext->vpt)) {
+		cf_log_err(cs, "Cannot use regular expression for 'switch' statement");
+		talloc_free(g);
+		return NULL;
+	}
+
 	if (!tmpl_is_attr(gext->vpt)) (void) tmpl_cast_set(gext->vpt, FR_TYPE_STRING);
 
 	/*
@@ -2099,6 +2111,17 @@ static unlang_t *compile_case(unlang_t *parent, unlang_compile_t *unlang_ctx, CO
 		/*
 		 *	Do type-specific checks on the case statement
 		 */
+		if (tmpl_is_list(vpt)) {
+			cf_log_perr(cs, "Cannot use list for target of 'case' statement");
+			talloc_free(vpt);
+			return NULL;
+		}
+
+		if (tmpl_contains_regex(vpt)) {
+			cf_log_err(cs, "Cannot use regular expression for target of 'case' statement");
+			talloc_free(vpt);
+			return NULL;
+		}
 
 		/*
 		 *	This "case" statement is unresolved.  Try to
@@ -2114,7 +2137,7 @@ static unlang_t *compile_case(unlang_t *parent, unlang_compile_t *unlang_ctx, CO
 			if ((cast_type == FR_TYPE_INVALID) && da) cast_type = da->type;
 
 			if (tmpl_cast_in_place(vpt, cast_type, da) < 0) {
-				cf_log_perr(cs, "Invalid argument for case statement");
+				cf_log_perr(cs, "Invalid argument for 'case' statement");
 				talloc_free(vpt);
 				return NULL;
 			}