Fixes for secrets: improved secret name validation.

corpsee · corpsee · commit ce20e6bd38c2 · 2022-08-30T13:50:30.000+07:00
diff --git a/src/Controller/SecretController.php b/src/Controller/SecretController.php
@@ -100,7 +100,7 @@ public function edit(?int $secretId = null)
         $field
             ->setClass('form-control')
             ->setContainerClass('form-group')
-            ->setPattern('^[^\s]+')
+            ->setPattern('^[-_\w\d]+$')
             ->setValue($secret->getName());
         $form->addField($field);
 
diff --git a/src/Form/Input.php b/src/Form/Input.php
@@ -129,7 +129,7 @@ public function validate(): bool
             return false;
         }
 
-        if ($this->getPattern() && !\preg_match('/' . $this->getPattern() . '/', (string)$this->getValue())) {
+        if ($this->getPattern() && !\preg_match('#' . $this->getPattern() . '#', (string)$this->getValue())) {
             $this->error = 'Invalid value entered.';
 
             return false;
diff --git a/src/Helper/BuildInterpolator.php b/src/Helper/BuildInterpolator.php
@@ -103,7 +103,7 @@ private function realtimeInterpolate(string $input): string
 
     private function secretInterpolate(string $input): string
     {
-        \preg_match_all('#%SECRET:(.+?)%#', $input, $matches);
+        \preg_match_all('#%SECRET:([-_\w\d]+)?%#', $input, $matches);
         if (!empty($matches[0])) {
             $secrets = $this->secretStore->getByNames($matches[1]);
             $finalSecrets = [];

Original file line number	Diff line number	Diff line change
`@@ -129,7 +129,7 @@ public function validate(): bool`
`129`	`129`	`return false;`
`130`	`130`	`}`
`131`	`131`
`132`		`- if ($this->getPattern() && !\preg_match('/' . $this->getPattern() . '/', (string)$this->getValue())) {`
	`132`	`+ if ($this->getPattern() && !\preg_match('#' . $this->getPattern() . '#', (string)$this->getValue())) {`
`133`	`133`	`$this->error = 'Invalid value entered.';`
`134`	`134`
`135`	`135`	`return false;`
Original file line number	Diff line number	Diff line change
`@@ -103,7 +103,7 @@ private function realtimeInterpolate(string $input): string`
`103`	`103`
`104`	`104`	`private function secretInterpolate(string $input): string`
`105`	`105`	`{`
`106`		`- \preg_match_all('#%SECRET:(.+?)%#', $input, $matches);`
	`106`	`+ \preg_match_all('#%SECRET:([-_\w\d]+)?%#', $input, $matches);`
`107`	`107`	`if (!empty($matches[0])) {`
`108`	`108`	`$secrets = $this->secretStore->getByNames($matches[1]);`
`109`	`109`	`$finalSecrets = [];`