[SVN-4204] Access control via authz cannot handle square brackets in paths

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.7.x
• Fix Version/s: unscheduled
• Component/s: libsvn_subr
• Assignee: Unassigned
• Reporter: Subversion Importer
• Created: 12/Jul/12 09:59
• Updated: 03/Dec/18 04:54

Description

If an SVN repository uses an authz file for access control, paths that contain the 
"]" character cannot have access control applied to them.

The problem is in "parse_section_name" in config_file.c - the function will 
interpret the first "]" character as closing the section name (line 332). This 
results in the access control being applied to a truncated path. I will attach a 
script that demonstrates the problem. I've tried the script on Ubuntu 11.10 using 
Subversion 1.7.4[1]. This has been discussed in more detail on the mailing 
list[2].

The parsing code could be fixed, or it could be documented that "]" is not legal 
for repositories using an authz file (personally I think fixing the code would be 
better!).

[1] From this PPA: https://launchpad.net/~dominik-stadler/+archive/subversion-1.7
[2] http://thread.gmane.org/gmane.comp.version-control.subversion.user/110747

Original issue reported by detly

Issue Links

• is duplicated by: SVN-2674 authz file format doesn't support path names containing [ or ]
• is related to: SVN-4784 auto-props cannot match filename patterns starting with [
• is related to: SVN-4795 Support character classes in glob authz rules
• mentioned in: Page Loading...