Copilot commented on code in PR #13674:
URL: https://github.com/apache/trafficserver/pull/13674#discussion_r4002878253
##########
doc/admin-guide/configuration/hrw4u.en.rst:
##########
@@ -717,16 +717,22 @@ validated.
Functions
---------
-The ``functions`` list accepts any of the statement-function names used in
-HRW4U source. The complete set of deniable functions is:
+The ``functions`` list accepts any of the function names used in HRW4U source,
+both statement functions and the functions that produce a value in an
+expression. The complete set of deniable functions is:
Review Comment:
This paragraph now calls the table the complete set, but it still omits the
valid `set-body` and `set-body-from-file` statement functions
(`tools/hrw4u/src/tables.py:67-69`, also present in the schema). That can
prevent administrators from discovering policy names—especially the
file-loading function—when constructing a deny list; add both entries to this
table.
##########
tools/hrw4u/src/symbols.py:
##########
@@ -181,6 +181,8 @@ def resolve_condition(self, name: str, section: SectionType
| None = None) -> tu
def resolve_function(self, func_name: str, args: list[str], strip_quotes:
bool = False) -> str:
with self.debug_context("resolve_function", func_name, args):
+ self._collect_warning(self._sandbox.check_function(func_name))
Review Comment:
This check also runs for `{txn-count()}`-style string interpolations, but
`_substitute_strings` catches the resulting `SandboxDenialError` as a generic
exception, substitutes an `{ERROR: ...}` value, and lets the assignment
continue. `generate_output` still prints the visitor result when the collector
has errors, so an interpolation-only denial can emit invalid output and return
success instead of rejecting the input. Propagate the denial (or suppress
output and return a failure for collected sandbox errors), and add a test
covering an interpolation-only denied function.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
