masaori335 commented on PR #13674:
URL: https://github.com/apache/trafficserver/pull/13674#issuecomment-5862703495
@cmcfarlen Thanks for the review. Rebased on master and addressed in
b5d44c346a.
**Interpolation (blocking)**: _substitute_strings now handles
SandboxDenialError separately. The denial is recorded through the visitor's
trap, so the policy message is set, and substitution continues with the rest of
the string. I went with recording it in place rather than propagating it: a
re-raised denial stopped the rest of the string from being checked, so
"{txn-count()} {inbound.method}" reported only the first denial. Denied
conditions inside interpolations are covered the same way. New fixtures:
denied-interpolated-function, where the only denied construct is inside an
interpolation, and denied-interpolated-multiple. Both fail on the previous
code. I kept the change to SandboxDenialError only; the {ERROR: ...} downgrade
for other symbol errors is what lets one pass collect several errors.
**Warning collected before argument validation** (symbols.py:184): the same
leak exists in the other resolvers, and a warned condition warns only on its
first use because of the visitor's lru_cache. I'll fix those together in a
follow-up PR.
**Validating functions entries at load** (sandbox.py:97): also a follow-up
PR, together with validating the other policy lists.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
