fix bug in acl config validation

eclipse-zenoh · Apr 26, 2024 · 76220b7 · 76220b7
1 parent 7c64d99
commit 76220b7
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 1 deletion.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/zenoh/src/net/routing/interceptor/access_control.rs b/zenoh/src/net/routing/interceptor/access_control.rs
@@ -66,7 +66,7 @@ pub(crate) fn acl_interceptor_factories(
                     enforcer: Arc::new(policy_enforcer),
                 }))
             }
-            Err(e) => tracing::error!("Access control inizialization error: {}", e),
+            Err(e) => tracing::error!("Access control not enabled due to: {}", e),
         }
     } else {
         tracing::debug!("Access control is disabled");

diff --git a/zenoh/src/net/routing/interceptor/authorization.rs b/zenoh/src/net/routing/interceptor/authorization.rs
@@ -199,10 +199,24 @@ impl PolicyEnforcer {
     ) -> ZResult<PolicyInformation> {
         let mut policy_rules: Vec<PolicyRule> = Vec::new();
         for config_rule in config_rule_set {
+            // config validation
+            if config_rule.interfaces.is_empty()
+                || config_rule.actions.is_empty()
+                || config_rule.flows.is_empty()
+                || config_rule.key_exprs.is_empty()
+            {
+                bail!("error from bad config");
+            }
             for subject in &config_rule.interfaces {
+                if subject.trim().is_empty() {
+                    bail!("error from bad interface value");
+                }
                 for flow in &config_rule.flows {
                     for action in &config_rule.actions {
                         for key_expr in &config_rule.key_exprs {
+                            if key_expr.trim().is_empty() {
+                                bail!("error from bad key-expression value");
+                            }
                             policy_rules.push(PolicyRule {
                                 subject: Subject::Interface(subject.clone()),
                                 key_expr: key_expr.clone(),