fix: escape regex metacharacters in WildcardMatch#2916
Open
vsaraikin wants to merge 1 commit into
Open
Conversation
WildcardMatch built a regex from the task name translating only "*", then
called regexp.MustCompile on it. A task name containing a regex metacharacter
either panicked (e.g. "c++" -> "invalid nested repetition operator") or
matched too loosely ("a.b" matched "axb"). Since FindMatchingTasks calls
WildcardMatch on every task, one such name breaks matching for the whole
Taskfile. Escape the name with regexp.QuoteMeta, keeping "*" as the only
wildcard.
Member
|
Did you read our contribution guide? https://taskfile.dev/docs/contributing#ai-usage-policy |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A task whose name contains a regex metacharacter breaks task matching for the whole Taskfile — either with a hard panic or a silent mis-match.
(*Task).WildcardMatchbuilds a regex from the task name, translating only*, and callsregexp.MustCompileon it:The raw task name is injected into the pattern, so any other metacharacter is interpreted as regex syntax:
c++yields^c++$, andregexp.MustCompilepanics withinvalid nested repetition operator: ++.a.bmatches the callaxb(the.acts as a wildcard). A realistic footgun:deploy.prodgets run by a mistypedtask deploy-prod.FindMatchingTaskscallsWildcardMatch(call.Task)on every task whenever the requested name isn't a direct/alias match, so a single task with such a name breaks matching for the entire Taskfile.Fix
Escape the task name with
regexp.QuoteMetabefore building the pattern, then turn the (now escaped)\*back into the wildcard group:*remains the only wildcard; everything else is matched literally.Testing
Added
TestTaskWildcardMatchcovering the existingbuild-*wildcard behavior plus the metacharacter cases (c++,a.b,deploy.prod). On the current code the test panics (invalid nested repetition operator); with the fix it passes. The fulltaskfile/astpackage suite passes and the module builds clean.