[FIXED] Durable/Consumer name checks

We need to reject names that contain '.', ' ', '*' or '>'. Resolves #581 Signed-off-by: Ivan Kozlovic <[email protected]>
nats-io · Sep 19, 2022 · c98976b · c98976b
1 parent 5b8f3aa
commit c98976b
Show file tree

Hide file tree

Showing 3 changed files with 51 additions and 17 deletions.
diff --git a/src/js.c b/src/js.c
@@ -2130,9 +2130,20 @@ _processConsInfo(const char **dlvSubject, jsConsumerInfo *info, jsConsumerConfig
 natsStatus
 js_checkConsName(const char *cons, bool isDurable)
 {
-    if (strchr(cons, '.') != NULL)
-        return nats_setError(NATS_INVALID_ARG, "%s '%s' (cannot contain '.')",
-            (isDurable ? jsErrInvalidDurableName : jsErrInvalidConsumerName), cons);
+    int i;
+
+    if (nats_IsStringEmpty(cons))
+        return nats_setError(NATS_INVALID_ARG, "%s", jsErrConsumerNameRequired);
+
+    for (i=0; i<(int)strlen(cons); i++)
+    {
+        char c = cons[i];
+        if ((c == '.') || (c == ' ') || (c == '*') || (c == '>'))
+        {
+            return nats_setError(NATS_INVALID_ARG, "%s '%s' (cannot contain '%c')",
+                (isDurable ? jsErrInvalidDurableName : jsErrInvalidConsumerName), cons, c);
+        }
+    }
     return NATS_OK;
 }
 

diff --git a/src/jsm.c b/src/jsm.c
@@ -1876,18 +1876,6 @@ jsRePublish_Init(jsRePublish *rp)
 // Consumer related functions
 //
 
-static natsStatus
-_checkConsumerName(const char *consumer)
-{
-    if (nats_IsStringEmpty(consumer))
-        return nats_setError(NATS_INVALID_ARG, "%s", jsErrConsumerNameRequired);
-
-    if (strchr(consumer, '.') != NULL)
-        return nats_setError(NATS_INVALID_ARG, "%s '%s' (cannot contain '.')", jsErrInvalidConsumerName, consumer);
-
-    return NATS_OK;
-}
-
 static natsStatus
 _marshalDeliverPolicy(natsBuffer *buf, jsDeliverPolicy p)
 {
@@ -2412,7 +2400,7 @@ js_GetConsumerInfo(jsConsumerInfo **new_ci, jsCtx *js,
         return nats_setDefaultError(NATS_INVALID_ARG);
 
     s = _checkStreamName(stream);
-    IFOK(s, _checkConsumerName(consumer))
+    IFOK(s, js_checkConsName(consumer, false))
     if (s != NATS_OK)
         return NATS_UPDATE_ERR_STACK(s);
 
@@ -2466,7 +2454,7 @@ js_DeleteConsumer(jsCtx *js, const char *stream, const char *consumer,
         return nats_setDefaultError(NATS_INVALID_ARG);
 
     s = _checkStreamName(stream);
-    IFOK(s, _checkConsumerName(consumer))
+    IFOK(s, js_checkConsName(consumer, false))
     if (s != NATS_OK)
         return NATS_UPDATE_ERR_STACK(s);
 

diff --git a/test/test.c b/test/test.c
@@ -22873,6 +22873,20 @@ test_JetStreamMgtConsumers(void)
     };
     jsReplayPolicy          replayPolicies[] = {
         js_ReplayInstant, js_ReplayOriginal};
+    const char              *badConsNames[] = {
+        "foo.bar",
+        ".foobar",
+        "foobar.",
+        "foo bar",
+        " foobar",
+        "foobar ",
+        "foo*bar",
+        "*foobar",
+        "foobar*",
+        "foo>bar",
+        ">foobar",
+        "foobar>",
+    };
 
     JS_SETUP(2, 9, 0);
 
@@ -22917,6 +22931,27 @@ test_JetStreamMgtConsumers(void)
                 && (strstr(nats_GetLastError(NULL), jsErrInvalidDurableName) != NULL));
     nats_clearLastError();
 
+    s = NATS_OK;
+    test("Add consumer, invalid name: ");
+    jsConsumerConfig_Init(&cfg);
+    for (i=0; (s == NATS_OK) && (i<(int)(sizeof(badConsNames)/sizeof(char*))); i++)
+    {
+        cfg.Name = badConsNames[i];
+        fprintf(stderr, "@@IK: trying with cons=%s\n", cfg.Name);
+        fflush(stderr);
+        s = js_AddConsumer(&ci, js, "MY_STREAM", &cfg, NULL, NULL);
+        if ((s == NATS_INVALID_ARG) && (ci == NULL)
+                && (strstr(nats_GetLastError(NULL), jsErrInvalidConsumerName) != NULL))
+        {
+            nats_clearLastError();
+            s = NATS_OK;
+        } else {
+            printf("@@IK: s=%d\n", s);
+            nats_PrintLastErrorStack(stderr);
+        }
+    }
+    testCond(s == NATS_OK);
+
     test("Create check sub: ");
     s = natsConnection_SubscribeSync(&sub, nc, "$JS.API.CONSUMER.CREATE.MY_STREAM");
     testCond(s == NATS_OK);