Commit Graph
165 Commits
Author SHA1 Message Date
Lennart Poettering 6acae8d17d string-util: do not accept ',' in version strings
Allowing this apparently has been cargo-culted from my initial sysupdate
PR, but Claude and me could not find a single other software package
that uses "," as a character within version strings. Hence, let's remove
this, even though this is a compat breakage of a kind, in the hope
nobody notices. We can easily restore this if this later shows to be an
issue for people.
2026-07-14 22:32:27 +02:00
Zbigniew Jędrzejewski-Szmek 3498b84013 Couple of hardening changes for utils flagged by kres (#42732) 2026-06-25 14:31:35 +02:00
Michael Vogt bc4dfc24a5 basic: add assert() when doing pointer deref
Lennart reminded me in [1] that we need to add assert() in functions
that do pointer access. For the simple `*p` pointer dereferences
we even have an automatic coccinelle script that ensures that as
part of the automatic code checks.

However for deref in the `p->` style this is not supported right
now and adding it to coccinelle is hard because its too slow for
this kind of check. So I created a (slightly messy) tree-sitter
python script to see how many asserts we are currently missing.

This commit is the result of running it over the `src/basic`
dir and fixing the flagged issues. I plan to tidy it up and
add it to the checks too but this is orthogonal to this commit.

[1] https://github.com/systemd/systemd/pull/42360#discussion_r3426964562
2026-06-25 10:40:21 +02:00
Luca Boccassi f66144cf2a string-util: check for short input in previous_ansi_sequence()
ellipsize_mem() scans backwards for ANSI escape sequences and calls
previous_ansi_sequence(s, t - s, ...) as t walks down toward s. When
t reaches s + 1 the helper is invoked with length == 1 and computes
'length - 2', which wraps to SIZE_MAX - 1.

Follow-up for cb558ab222
2026-06-24 14:48:04 +01:00
Lennart Poettering 710d5aebbb sysupdate: keep database of installed files/patterns, and use to GC them (#42646)
Transfer files might come and go, components might be enabled and
disabled. Patterns might change. Let's keep track of what we install, so
that we can automatically gc everything no longer owned by any enabled
transfer.
2026-06-22 17:19:46 +02:00
Lennart Poettering dbd35fdc81 string-util: introduce STRING_FILENAME_PART flag for string_is_safe()
Whenever we are validating a string that shall appear in a filename
eventually we want to use filename_part_is_valid() rather than file
filename_is_valid(). Let's add explicit support for that to
string_is_safe(), since it's actually a really common case.
2026-06-22 14:41:16 +02:00
Lennart Poettering 4552dce3b5 string-util: make split_pair() return parameters optional 2026-06-19 23:05:36 +02:00
Luca Boccassi 9404fa70df string-util: add STRING_DISALLOW_WHITESPACE for string_is_safe
Co-developed-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-17 13:11:15 +01:00
Yu Watanabe b74f016e59 string-util: introduce STRING_ALLOW_NEWLINES switch for string_is_safe()
This also make StringSafeFlags defined in basic-forward.h so other
headers can use the enum.
2026-05-18 02:55:34 +09:00
Lennart Poettering 812aa57d2c string-util: beef up string_is_safe()
This tightens the checks of string_is_safe() and then adds flags to
relax certain aspects of it.

This does alter the rules on certain strings we pass a bit. We mostly
tighten the rules (but I think it's find and good) but we relax them on
others.

I let claude review the changes in behaviour for the various call sites
that I made. It summarized things in this table:

  ╭───────────────────────────────────────────────────┬──────────────────────────────────────────────╮
  │ CALL SITE                                         │ EFFECTIVE DELTA                              │
  ├───────────────────────────────────────────────────┼──────────────────────────────────────────────┤
  │ src/basic/syslog-util  log_namespace_name_valid   │ +UTF-8 required (globs already blocked)      │
  │ src/bootctl  --efi-boot-option-description        │ RELAXED: '\' and quotes now permitted        │
  │ src/core/dbus-manager  pretimeout governor        │ +UTF-8, +no-globs                            │
  │ src/core/load-fragment  ExecStart= path           │ +UTF-8, +no-globs                            │
  │ src/core/main  pretimeout governor (kcmdline)     │ +UTF-8, +no-globs                            │
  │ src/core/service  sd_notify STATUS=               │ +no-globs (ASCII-only preserved)             │
  │ src/home/homectl  --<identity field>=             │ empty now REJECTED; +UTF-8                   │
  │ src/libsystemd-network  dhcp_option_parse_string  │ (equivalent, just explicit)                  │
  │ src/libsystemd-network  sd_dhcp_server boot_fname │ ""→NULL coerced; else equivalent             │
  │ src/libsystemd/journal  SYSLOG_IDENTIFIER fb      │ +UTF-8, +no-globs                            │
  │ src/libsystemd/sd-json  SD_JSON_STRICT strings    │ +UTF-8 required                              │
  │ src/login/logind  session desktop=                │ +UTF-8 required                              │
  │ src/pcrlock  EFI variable string                  │ +UTF-8                                       │
  │ src/pcrlock  EFI action string                    │ RELAXED: empty + '\' now ok; +UTF-8          │
  │ src/resolve  dns-delegate id (from filename)      │ +UTF-8, +no-globs                            │
  │ src/shared/boot-entry  boot_entry_token_valid     │ (equivalent)                                 │
  │ src/shared/conf-parser  section header            │ +UTF-8, +no-globs                            │
  │ src/shared/conf-parser  CONFIG_PARSE_STRING_SAFE  │ +UTF-8 required                              │
  │ src/shared/kbd-util  keymap_is_valid              │ (equivalent; folded into STRING_FILENAME)    │
  │ src/shared/tpm2  nvpcr name                       │ +UTF-8 required                              │
  │ src/shared/vconsole  x11 layout/model/variant/opt │ +UTF-8, +no-globs                            │
  │ src/systemctl  --kernel-cmdline=                  │ +0x7f DEL rejected; empty path split out     │
  │ src/veritysetup  salt=                            │ RELAXED: safety check removed entirely       │
  │ src/vmspawn  --ssh-key-type=                      │ +UTF-8 required                              │
  ╰───────────────────────────────────────────────────┴──────────────────────────────────────────────╯
2026-04-21 17:07:53 +02:00
Lennart Poettering 4368cc8164 Various useful helpers (#41684)
Split out of #41543.

These don't make too much sense on their own, but they also don't really
hurt. They are preparation for #41543, but in order to make things
either to review I split these four commits out, since they are not
directly part of what the PR shall achieve
2026-04-18 09:50:19 +02:00
Yu Watanabe 8bb669712e string-util: make make_cstring() take void* rather than char*
It is typically used for making C string embedded in a binary data.
Hence, the input pointer may not be char*.
2026-04-17 19:24:53 +02:00
Lennart Poettering d7b6d89d90 string-util: add minor optimization to strrstr() 2026-04-17 18:32:21 +02:00
Lennart Poettering 2561159d39 string-util: add new strrstr_no_case() call 2026-04-17 18:32:20 +02:00
Frantisek Sumsal b22daa97e1 string-util: check for overflow in strrep()
This simply mirrors the same overflow check we already have in
strrepa(), in case someone passed us a sufficiently long string.

strrep() is currently used only in tests, so this is just hardening.
2026-04-16 17:46:31 +02:00
Michael Vogt bd141bd818 many: fix remaining check-pointer-deref issues
The updated parsing_hacks.h file uncovered a bunch of extra
things that the check-pointer-deref coccinelle script flags.

This commit fixes them to make the tree check-pointer-deref clean.
2026-04-12 15:27:15 +02:00
Michael Vogt 18e70eec2f basic: make check-pointer-deref clean
Add the needed assert changes to make the code clean
for the new check-pointer-deref script.

Note that for `_cmp()` functions its a bit of a question
if we want `assert()` or `POINTER_MAY_BE_NULL()` here. The
former is more correct but it adds a (small) runtime hit. If
we use POINTER_MAY_BE_NULL() it is compiled out but strictly
speaking it is wrong (so at least we would need a comment).
2026-03-31 18:30:40 +02:00
Chris Down 0a66431031 string-util: Prevent infinite loop pegging CPU on malformed ESC input
string_has_ansi_sequence() currently does this to look for ESC input:

    t = memchr(s, 0x1B, ...)

So each iteration re-searches from the original start pointer. But if we
find an ESC byte that does *not* start a valid ANSI sequence (like "\x1B
", or an ESC at the end of the string), then ansi_sequence_length()
returns 0, and if that ESC is still in the search window, we will just
spin consuming 100% CPU forever.

Fix this by always advancing past rejected ESC bytes.
2026-02-14 21:49:24 +01:00
Lennart Poettering e09b5366e5 string-util: accept ":" when stripping ANSI color sequences
Since 6eabe9f2ff we generate sequences
with ":", hence we better also know how to strip them.

(Without this patch we'd strip simple ANSI colors, but not RGB ones that
use ":" syntax).

(While we are at it, also drop a duplicate "0" in the list of valid
chars)
2026-01-17 12:07:36 +01:00
Yu Watanabe 93378148d4 tree-wide: normalize comment style 2025-12-15 08:50:13 +09:00
Daan De Meyer 6a9f0641cd tree-wide: Fix declaration/definition parameter name mismatches 2025-11-26 19:02:31 +09:00
Daan De Meyer 0bac1ed242 tree-wide: Fix constness issues with newer glibc
Latest glibc uses _Generic to have strstr() and other functions return
const char* or char* based on whether the input is a const char* or a
char*. This causes build failures as we previously always expected a char*.

Let's fix the compilation failures and add our own macros similar to glibc's
to have string functions that return a mutable or const pointer depending on
the input.
2025-11-25 20:49:39 +01:00
Yu Watanabe 69350ee3e3 string-util: introduce strextendv_with_separator() 2025-11-01 00:58:42 +09:00
Mike Yuan d9bf815093 string-util: introduce strprepend_with_separator() 2025-06-11 12:50:51 +09:00
Daan De Meyer 0c15577abe basic + fundamental: Clean up includes
Split out of #37344.
2025-05-25 10:06:07 +02:00
Alberto Planas ba2d8107e2 string-util: add find_line[_after] functions
As a wrapper for `find_line_startswith`, `find_line_after` search for
the exact line and return the pointer for the next line, or NULL if
missing.

`find_line` with search for the exact line and return the pointer to the
beginning of the line.

Signed-off-by: Alberto Planas <aplanas@suse.com>
2025-05-20 10:29:33 +02:00
Daan De Meyer e4a08721c3 string-util: Remove utf8.h and alloc-util.h includes 2025-05-06 13:27:54 +02:00
Daan De Meyer 93a1f7921a basic: Stop including log.h in macro.h
Now that the necessary functions from log.h have been moved to macro.h,
we can stop including log.h in macro.h. This requires modifying source
files all over the tree to include log.h instead.
2025-04-18 14:19:15 +02:00
Zbigniew Jędrzejewski-Szmek 1ae9b0cfa8 basic/glyph-util: rename "special glyph" to just "glyph"
Admittedly, some of our glyphs _are_ special, e.g. "O=" for SPECIAL_GLYPH_TOUCH ;)
But we don't need this in the name. The very long names make some invocations
very wordy, e.g. special_glyph(SPECIAL_GLYPH_SLIGHTLY_UNHAPPY_SMILEY).
Also, I want to add GLYPH_SPACE, which is not special at all.
2025-03-15 14:40:39 +01:00
Yu Watanabe 5c9feb2d6e tree-wide: drop unnecessary break in default branch 2025-03-06 11:42:20 +01:00
Lennart Poettering f77f363c95 string-util: add str_common_prefix() helper that determines length of common prefix of two strings 2025-02-17 14:57:03 +01:00
Mike Yuan 63ed611579 string-util: modernize strextendn() a bit
l == SIZE_MAX requires no special handling, since we assert
on (s || l == 0) above.
2025-02-10 19:39:22 +01:00
Mike Yuan 146b2ed6a6 string-util: drop now unused strnappend() 2025-02-10 19:39:22 +01:00
Mike Yuan b40694f5fc string-util: introduce strprepend() helper 2025-02-10 19:39:21 +01:00
Lennart Poettering fd3b7cf772 string-util: add a mechanism for strextend_with_separator() for specifying "ignore" arguments
in strv_new() we have STRV_IGNORE for skipping over an argument in the
argument list. Let's add the same to strextend_with_separator():

strextend_with_separator(&x, "foo", POINTER_MAX, "bar");

will result in "foobar" being appended to "x". (POINTER_MAX Which is
different from NULL, which terminates the argument list).

This is useful for ternary op situations.

(We should probably get rid of STRV_IGNORE and just use POINTER_MAX
everywhere directly, but that's for another time.)
2025-01-15 10:52:38 +01:00
Lennart Poettering 34467ffa3c string-util: make strjoin() just a special case of strextend()
The functions are very similar, let's make them the same. If the first
argument to strextend() is NULL instead of extending a string we'll
allocate a fresh one and return that.
2025-01-15 10:51:53 +01:00
Yu Watanabe ac3f3026a9 string-util: modernize split_pair()
- use _cleanup_free_ attribute,
- rename output arguments,
- trigger assertion when an empty separator is passed.
2024-12-28 16:16:27 +09:00
Lennart Poettering 0823d96a0b pretty-print: don't use OSC 8 for incompatible URLs 2024-12-11 10:35:03 +01:00
Lennart Poettering f79562aaee string-util: split out EOT check in strip_tab_ansi()
Let's unify the eot check in one place in order to make things more
readable.
2024-12-11 10:35:03 +01:00
Lennart Poettering a39c51799b string-util: also check for 0x1b 0x5c ST when stripping ANSI from strings 2024-10-31 11:38:18 +01:00
Lennart Poettering e65b0904a0 string-util: it's called OSC sequence, not CSO sequence 2024-10-31 11:28:57 +01:00
Zbigniew Jędrzejewski-Szmek ff3f29537c various: move ptr indicator to return value 2024-06-19 16:37:12 +02:00
Mike Yuan c1bf0571c0 string-util: modernize first_word a bit 2024-06-15 19:19:39 +02:00
Mike Yuan c498b2f7ee string-util: use mempcpy where appropriate 2024-04-17 17:04:23 +08:00
Yu Watanabe d723363a86 string-util: use special_glyph() at one more place
No functional change, just refactoring.
2024-04-17 17:03:49 +08:00
Mike Yuan dbbc86ffbd string-util: correct comment in strextendf_with_separator 2024-04-13 02:35:01 +08:00
Mike Yuan 596c9e671a string-util: add missing assertion in cellescape 2024-04-03 23:51:11 +08:00
Mike Yuan f8c700791e string-util: modernize string_contains_word_strv a bit
Also correct the comment on flags.
2024-03-28 17:16:25 +08:00
Zbigniew Jędrzejewski-Szmek f174b294f6 basic/string-util: use strdup_to() in string_extract_line() 2024-03-20 15:18:21 +01:00
Zbigniew Jędrzejewski-Szmek 892c5902ae src/basic: add yet another strdup helper
It's a bit ugly to have both strdup_to() and strdup_to_full(). I initially
started with one variant, but then in some functions we want the additional
info, while in many other places, having 1 instead of 0 causes the return
value of whole chains of functions to be changed. It *probably* wouldn't cause
any difference, but there is at least of bunch of tests that would need to be
updated, so in the end it seems to have the two variants.

The output param is first to match free_and_strdup() and other similar
functions.
2024-03-20 15:12:12 +01:00