Bug 265001 - /boot/loader: Lua: lines containing a comment that contains a '"' in loader.conf are ignored
Summary: /boot/loader: Lua: lines containing a comment that contains a '"' in loader.c...
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 13.2-RELEASE
Hardware: Any Any
: --- Affects Some People
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-07-02 19:38 UTC by crahman
Modified: 2023-04-09 08:21 UTC (History)
1 user (show)

See Also:


Attachments
Prevent '"' from being incorporated into name="value" pairs in /boot/loader.conf (1.40 KB, patch)
2022-07-28 12:27 UTC, crahman
no flags Details | Diff
Prevent '"' from being incorporated into name="value" pairs in /boot/loader.conf (523 bytes, patch)
2022-07-28 12:29 UTC, crahman
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description crahman 2022-07-02 19:38:36 UTC
If the following entries are made into /boot/loader.conf:

test_directive_a="test a"               # This is test_directive_a
test_directive_b="test b"               # This is "test_directive_b"
test_directive_c="test c"               # This is 'test_directive_b'

then the middle comment will not appear in the kernel environment.
Comment 1 crahman 2022-07-28 12:26:38 UTC
So the problem is that the lua parser in /boot/lua/config.lua is splitting the line on the '=', sending the first match to the key and the second to the value.

In the problem case, the value is:
   '"test b"               # This is "test_directive_b"'

Then the value gets matched against QVALEXPR = '"(.*)"'.

This cleans up the value by removing the first and last '"', but in this case turns it into:

  test b"               # This is "test_directive_b

which then gets rejected in processEnvVar() with MSG_FAILSYN_QUOTE, since
values aren't allowed to contain '"'.

Changing QVALEXPR to '([-%w_]+)' fixes this problem.  Since the value is explicitly prevented from containing quotes, it's not unreasonable to load it from an expression that excludes them.  The only other place this is used is in the 'exec="command"' expression, which also should not contain '"' in the command value.

A patch is attached.
Comment 2 crahman 2022-07-28 12:27:47 UTC
Created attachment 235527 [details]
Prevent '"' from being incorporated into name="value" pairs in /boot/loader.conf
Comment 3 crahman 2022-07-28 12:29:46 UTC
Created attachment 235528 [details]
Prevent '"' from being incorporated into name="value" pairs in /boot/loader.conf