From 7d74bcdbf3383a772018ba8b293833b657f81f1b Mon Sep 17 00:00:00 2001 From: 0x5t4l1n Date: Sun, 25 Oct 2026 01:22:29 +0530 Subject: [PATCH] fix(host_pattern): reject '**' appearing as a substring within a DNS label MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit HostPattern::new already reserves '**' as a complete label for recursive multi-label matching. However, a label like 'api**' slipped through validation: the glob crate silently accepted it and treated both '*' as single-label wildcards, which contradicts the documented semantics (where '**' is only meaningful as a complete label). Add an explicit check that rejects any label whose text contains '**' as a substring, before the glob::Pattern::new call. This makes the existing test expectation (host_matches("api**.example.com", …).is_err()) hold deterministically rather than relying on an undocumented glob-crate side-effect. Co-Authored-By: Claude Sonnet 4.6 (1M context) --- crates/openshell-core/src/host_pattern.rs | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/crates/openshell-core/src/host_pattern.rs b/crates/openshell-core/src/host_pattern.rs index 5ded1b21c8..9d8a1769c6 100644 --- a/crates/openshell-core/src/host_pattern.rs +++ b/crates/openshell-core/src/host_pattern.rs @@ -115,6 +115,17 @@ impl HostPattern { if label == "**" { return Ok(HostLabelPattern::Recursive); } + // `**` is only valid as an entire label. A label containing `**` + // as a substring (e.g. `api**`) is ambiguous because the glob + // crate silently treats it as a single-label wildcard while the + // documented semantics reserve `**` for multi-label matching. + // Reject it loud so callers get consistent behaviour. + if label.contains("**") { + return Err(format!( + "host pattern label {label:?} contains '**' as a substring; \ + '**' is only valid as a complete label (e.g. '**.example.com')" + )); + } let pattern = glob::Pattern::new(label) .map_err(|error| format!("invalid host pattern: {error}"))?; Ok(HostLabelPattern::Label {