• Binbin's avatar
    Block some specific characters in module command names (#11434) · 8764611c
    Binbin authored
    Today we don't place any specific restrictions on module command names.
    This can cause ambiguous scenarios. For example, someone might name a
    command like "module|feature" which would be incorrectly parsed by the
    ACL system as a subcommand.
    
    In this PR, we will block some chars that we know can mess things up.
    Specifically ones that can appear ok at first and cause problems in some
    cases (we rather surface the issue right away).
    
    There are these characters:
     * ` ` (space) - issues with old inline protocol.
     * `\r`, `\n` (newline) - can mess up the protocol on acl error replies.
     * `|` - sub-commands.
     * `@` - ACL categories
     * `=`, `,` - info and client list fields.
    
    note that we decided to leave `:` out as it's handled by `getSafeInfoString`
    and is more likely to already been used by existing modules.
    8764611c
subcommands.c 4.51 KB