aashish-confluent opened a new pull request, #24010: URL: https://github.com/apache/kafka/pull/24010
SslPrincipalMapper.Rule.apply checks the rule with Matcher.matches() but then builds the principal with String.replaceAll, which scans the DN again and can use a different match. For some rules (unanchored, or with alternation) this gives a wrong name, e.g. "bobeng" instead of "bob", or the replacement applied twice. Build the name from the same match with Matcher.appendReplacement. A rule that produces an empty name is now treated as not matching, so the next rule applies, the same way an invalid result is handled for Kerberos rules. Added unit tests in SslPrincipalMapperTest. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
