jsinovassin opened a new pull request, #886:
URL: https://github.com/apache/unomi/pull/886
## Summary
- Backport of #873 to `unomi-3.0.x`, re-cut from the current branch head.
- The identifier pattern `^(\w|[-_@\.]){0,60}$` has two alternatives that
both accept `_`, so a run of underscores followed by one rejected character
makes the matcher explore every division of the run. The equivalent
`^[\[email protected]]{0,60}$` accepts the same identifiers and evaluates in linear time.
- The three shipped schemas that carry the pattern are updated:
`requestIds.json`, `event.json` and `item.json`.
## Differences from master
This line has no tenancy, so three things differ from #873.
- `SchemaIdPatternSafetyIT` sends no API key, because the context endpoint
is public here. That is the surface the unbounded evaluation was reachable from
on this line.
- `AllITs` registers `SchemaIdPatternSafetyIT` alone. The other suites the
master commit lists do not exist here.
- `RequestIdsSchemaPatternSafetyTest` is added. The unit test that comes
with #873 lives in the json-schema services module and covers `event.json` and
`item.json`, while `requestIds.json` ships from the `rest` module and is the
schema `ContextRequestDeserializer` applies to a public `POST
/cxs/context.json`. It gets a guard of its own here rather than integration
coverage only.
Neither module had unit tests, so `junit` is added at test scope to both
poms.
## Test plan
- [x] `SchemaPatternSafetyTest` and `RequestIdsSchemaPatternSafetyTest` pass
locally on JDK 17.
- [x] Mutation-checked: restoring the ambiguous pattern in each of the three
schemas in turn makes the matching test fail on its timeout, which is the
symptom the test exists for.
- [x] `mvn test-compile` passes on `itests`.
- [ ] `SchemaIdPatternSafetyIT` under Karaf and Elasticsearch.
- [ ] CI
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
