From 01e8c6a477816452b801e8b47ca16319678b6c1f Mon Sep 17 00:00:00 2001
From: "Alan T. DeKok" <aland@freeradius.org>
Date: Sun, 29 Aug 2021 08:26:34 -0400
Subject: [PATCH] don't allow:  Foo = %{...}

it must be in a double-quoted string.
---
 src/main/map.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/main/map.c b/src/main/map.c
index 4396ed63ed..97a68da5fc 100644
--- a/src/main/map.c
+++ b/src/main/map.c
@@ -245,6 +245,18 @@ int map_afrom_cp(TALLOC_CTX *ctx, vp_map_t **out, CONF_PAIR *cp,
 		}
 		break;
 
+	case T_BARE_WORD:
+		/*
+		 *	Foo = %{...}
+		 *
+		 *	Not allowed!
+		 */
+		if ((attr[0] == '%') && (attr[1] == '{')) {
+			cf_log_err_cp(cp, "Bare expansions are not permitted.  They must be in a double-quoted string.");
+			goto error;
+		}
+		/* FALL-THROUGH */
+
 	default:
 		slen = tmpl_afrom_attr_str(ctx, &map->lhs, attr, dst_request_def, dst_list_def, true, true);
 		if (slen <= 0) {
-- 
2.47.2