Skip to content

Conversation

tvernum
Copy link
Contributor

@tvernum tvernum commented Jun 27, 2022

This commit fixes two issues with StringMatcherTests

Problem 1
Under some seeds (e.g. 3C93AEF7628D6611) prefix2 would start
with the same text as prefix1. This would mean that input that was
intended to test against prefix2 would actually match prefix1, and
violate the expectations of the test

Problem 2
The code had the equivalent of

randomFrom( "abc".toCharArray() )

But Hamcest does not have a randomFrom(char[]) method, so this
code was treated as

randomFrom( new Object[] { new char[] { 'a', 'b', 'c' } } )

and will return a char[]. Tests that were written assuming they had
a random character, actually had an array (char[]) and would then
stringify that object into something like

[C@5e67f506

Resolves: #88024

tvernum added 2 commits June 27, 2022 15:49
Under some seeds (e.g. 3C93AEF7628D6611) prefix2 would start with
prefix1, which would mean that input that was intended to test against
prefix2 would actually match prefix1

Resolves: elastic#88024
In Hamcest there is now randomFrom(char[]) so this code:

    randomFrom( "abc".toCharArray() )

will be treated as

    randomFrom( new Object[] { new char[] { 'a', 'b', 'c' } } )

and will return a char[]

The existing code that was intending to return a random char, was
actually returning a char[] and then stringifying that into something
like

   [C@5e67f506
@tvernum tvernum added >test Issues or PRs that are addressing/adding tests :Security/Security Security issues without another label v8.4.0 v8.3.1 labels Jun 27, 2022
@tvernum tvernum requested a review from n1v0lg June 27, 2022 07:18
@elasticmachine elasticmachine added the Team:Security Meta label for security team label Jun 27, 2022
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-security (Team:Security)

Copy link
Contributor

@n1v0lg n1v0lg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice catch(es)!

);

final List<Character> nonAlpha = "@/#$0123456789()[]{}<>;:%&".chars()
.mapToObj(c -> Character.valueOf((char) c))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Optional nit: I think boxing happens automatically here, i.e., c -> (char) c) is sufficient.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would, though I think explicit is preferable in this case.
I guess it's just going to come down to personal preference, but I like the clarity of the explicit boxing.

@tvernum tvernum merged commit 1cef841 into elastic:master Jun 28, 2022
tvernum added a commit to tvernum/elasticsearch that referenced this pull request Jun 28, 2022
This commit fixes two issues with StringMatcherTests

**Problem 1**
Under some seeds (e.g. 3C93AEF7628D6611) prefix2 would start
with the same text as prefix1. This would mean that input that was
intended to test against prefix2 would actually match prefix1, and
violate the expectations of the test

**Problem 2**
The code had the equivalent of

    randomFrom( "abc".toCharArray() )

But Hamcest does not have a randomFrom(char[]) method, so this
code was treated as

    randomFrom( new Object[] { new char[] { 'a', 'b', 'c' } } )

and will return a char[]. Tests that were written assuming they had 
a random character, actually had an array (char[]) and would then
stringify that object into something like

    [C@5e67f506

Resolves: elastic#88024
@elasticsearchmachine
Copy link
Collaborator

💚 Backport successful

Status Branch Result
8.3

elasticsearchmachine pushed a commit that referenced this pull request Jun 28, 2022
This commit fixes two issues with StringMatcherTests

**Problem 1**
Under some seeds (e.g. 3C93AEF7628D6611) prefix2 would start
with the same text as prefix1. This would mean that input that was
intended to test against prefix2 would actually match prefix1, and
violate the expectations of the test

**Problem 2**
The code had the equivalent of

    randomFrom( "abc".toCharArray() )

But Hamcest does not have a randomFrom(char[]) method, so this
code was treated as

    randomFrom( new Object[] { new char[] { 'a', 'b', 'c' } } )

and will return a char[]. Tests that were written assuming they had 
a random character, actually had an array (char[]) and would then
stringify that object into something like

    [C@5e67f506

Resolves: #88024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

:Security/Security Security issues without another label Team:Security Meta label for security team >test Issues or PRs that are addressing/adding tests v8.3.1 v8.4.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[CI] StringMatcherTests testMultiplePatterns failing

4 participants