Skip to content

Fix os-release parser capturing only the last character of quoted values - #40

Open
arpitjain099 wants to merge 1 commit into
trailofbits:mainfrom
arpitjain099:fix/os-release-quoted-values
Open

Fix os-release parser capturing only the last character of quoted values#40
arpitjain099 wants to merge 1 commit into
trailofbits:mainfrom
arpitjain099:fix/os-release-quoted-values

Conversation

@arpitjain099

Copy link
Copy Markdown

The /etc/os-release line pattern in PackagingConfig.get_local places the * quantifier outside the capture group:

r"\s*(?P<var>\S+)\s*=\s*(\"(?P<quoted>[^\"])*\"|(?P<unquoted>\S*)|\'(?P<singlequoted>[^\'])*\')\s*"

Because (?P<quoted>[^\"])* repeats the group, it rebinds on every iteration and keeps only the last matched character. On a normal host:

  • ID="ubuntu" becomes "u"
  • VERSION_ID="22.04" becomes "4"

There is a second issue: the unquoted alternative precedes the single-quote alternative and its \S* greedily consumes a single-quoted value including the quotes, so the singlequoted branch is dead.

These values flow into the apt Contents-DB URL, the Docker base-image tag, and the cache key, so they get corrupted to single characters (the VERSION_ID case is masked when an unquoted VERSION_CODENAME is present, since codename is preferred, but a quoted ID is not).

Fix: move the quantifiers inside the groups and order the quoted alternatives before the unquoted one. I also extracted a small parse_os_release_line helper so this is unit-testable without touching /etc/os-release. Added test/test_os_release.py; ran it under Python 3.13 (3 passing), and confirmed the old pattern returns the last-character values.

Thanks!

The /etc/os-release value pattern put the * quantifier outside the
capture group, so the group rebinds each iteration and keeps only the
final matched character: ID="ubuntu" parsed to "u" and VERSION_ID="22.04"
to "4". The unquoted alternative also preceded the single-quote one and
its \S* ate the surrounding quotes, leaving the singlequoted branch dead.

These values feed the apt Contents-DB URL, the Docker base-image tag,
and the cache key, so on a normal Linux host they were corrupted to
single characters.

Move the quantifiers inside the groups, order the quoted alternatives
before the unquoted one, and extract a testable parse_os_release_line
helper. Added a unit test.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant