anastasis

commit 005c6e3f0e3bcbc0ed53304991d0225a905de576
parent 7d34762b9effd510186721e97c5cbf5a22360d79
Author: Christian Grothoff <christian@grothoff.org>
Date:   Tue,  4 Aug 2026 15:25:52 +0200

fail if regex could not be compiled

Diffstat:
M
src/reducer/anastasis_api_redux.c
 | 
7
+++++--

1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/reducer/anastasis_api_redux.c b/src/reducer/anastasis_api_redux.c
@@ -909,11 +909,14 @@ validate_regex (const char *input,
                     regexp,
                     REG_EXTENDED))
   {
-    GNUNET_break (0);
+    /* The expression comes from the (untrusted) state, so failing to compile
+       it must not mean "input accepted": that would let a client disable the
+       check for an attribute simply by supplying a broken regex. */
+    GNUNET_break_op (0);
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 "Failed to compile regular expression `%s'.",
                 regexp);
-    return true;
+    return false;
   }
   /* check if input has correct form */
   if (0 != regexec (&regex,