hashicorp / hashicorp/go-secure-stdlib

kv-builder: Builder.add() mishandles filenames with equals ('=') signs

Open
#5 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
74
Forks
28
PR merge metrics
No merged PRs in 30d

Description

### Problem

When Builder.add() is called, it is splitting the values on `=` to look for key/value pairs. This doesn't take into account that `=` is a valid character for a filename, and will mishandle files containing that character. An example of such a case can be seen in [vault#12290](https://github.com/hashicorp/vault/issues/12290)

### Expected Result

When Builder.add(string) encounters a raw value such as `@cn=foo,o=example.com.json` then it should read k/v from file `cn=foo,o=example.com.json` and not set `{"@cn": "foo,o=example.com.json"}`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.