Re: [PATCH] BUG/MEDIUM: Expose all converters & fetches

2018-12-15 Thread Willy Tarreau
Hi Robin, On Fri, Dec 14, 2018 at 06:28:16AM +, Robin H. Johnson wrote: > On Fri, Dec 07, 2018 at 01:14:47PM +0100, Willy Tarreau wrote: > > I had a quick look, some converters use check_operator() which creates > > a variable upon each invocation of the parsing function. Some people > > might

Re: [PATCH] BUG/MEDIUM: Expose all converters & fetches

2018-12-13 Thread Robin H. Johnson
On Fri, Dec 07, 2018 at 01:14:47PM +0100, Willy Tarreau wrote: > I had a quick look, some converters use check_operator() which creates > a variable upon each invocation of the parsing function. Some people > might inadvertently get caught by using these ones to look up cookie > values or session i

Re: [PATCH] BUG/MEDIUM: Expose all converters & fetches

2018-12-07 Thread Willy Tarreau
Hello, On Thu, Dec 06, 2018 at 11:36:33PM -0800, Robin H. Johnson wrote: > One of my coworkers was having some trouble trying to escape data for > JSON in Lua, using the 'json' converter, based on the documentation, and > this lead to a deep bug discovery. > > The Lua documentation [1] states tha

[PATCH] BUG/MEDIUM: Expose all converters & fetches

2018-12-06 Thread Robin H. Johnson
One of my coworkers was having some trouble trying to escape data for JSON in Lua, using the 'json' converter, based on the documentation, and this lead to a deep bug discovery. The Lua documentation [1] states that JSON escaping converter is exposed in Lua, but it turns out that's not quite true.