Re: [PATCH] mcstrans: escape config text spliced into build_regexps() patterns

On Mon, Aug 17, 2026 at 10:16 AM James Carter <[email protected]> wrote:
>
> On Thu, Aug 13, 2026 at 2:41 PM Stephen Smalley
> <[email protected]> wrote:
> >
> > build_regexps() interpolates the base-classification, prefix/suffix
> > affix, word and Whitespace strings from the setrans configuration
> > directly into PCRE alternation patterns. A label containing a PCRE
> > metacharacter such as "." or "(" therefore either fails to compile,
> > matches unintended input, or produces a pathological regex that a
> > client can drive via TRANS_TO_RAW_CONTEXT. The Whitespace value goes
> > into a character class, where an unescaped "-" between two characters
> > is treated as a range and "]" ends the class early.
> >
> > Backslash-escape the fixed PCRE metacharacter set when appending
> > config-supplied text; the same escaping is safe both inside and
> > outside a character class. None of the shipped example configurations
> > carry metacharacters in these fields, so behaviour is unchanged for
> > them. The configuration is root-owned, so this is hardening rather
> > than a boundary crossing.
> >
> > Signed-off-by: Stephen Smalley <[email protected]>
>
> Acked-by: James Carter <[email protected]>

Thanks, merged.