hashicorp / hashicorp/go-secure-stdlib
kv-builder: Builder.add() mishandles filenames with equals ('=') signs
Open
- Dominant language
- Go
- Stars
- 74
- Forks
- 28
- PR merge metrics
- No merged PRs in 30d
Description
### Problem
When Builder.add() is called, it is splitting the values on `=` to look for key/value pairs. This doesn't take into account that `=` is a valid character for a filename, and will mishandle files containing that character. An example of such a case can be seen in [vault#12290](https://github.com/hashicorp/vault/issues/12290)
### Expected Result
When Builder.add(string) encounters a raw value such as `@cn=foo,o=example.com.json` then it should read k/v from file `cn=foo,o=example.com.json` and not set `{"@cn": "foo,o=example.com.json"}`
Contributor guide
Assessment
This issue has not been assessed yet.