BUG/MEDIUM: configuration: fix crashes and non-idempotent serialization

dkorunic · mjuraga · commit 78124a0ae229 · 2026-06-18T13:19:42.000Z
diff --git a/.aspell.yml b/.aspell.yml
@@ -233,3 +233,14 @@ allowed:
   - rehaul
   - rebase
   - XXXX
+  - bufio
+  - dereferences
+  - gosentry
+  - libafl
+  - reparse
+  - reparsing
+  - tokenization
+  - untrusted
+  - allowlist
+  - gocognit
+  - nolint
diff --git a/config-parser/parsers/acl.go b/config-parser/parsers/acl.go
@@ -56,8 +56,10 @@ func (h *ACL) Result() ([]common.ReturnResultLine, error) {
 		sb.WriteString(req.ACLName)
 		sb.WriteString(" ")
 		sb.WriteString(req.Criterion)
-		sb.WriteString(" ")
-		sb.WriteString(req.Value)
+		if req.Value != "" {
+			sb.WriteString(" ")
+			sb.WriteString(req.Value)
+		}
 
 		comment, err := misc.SerializeMetadata(req.Metadata)
 		if err != nil {
diff --git a/config-parser/parsers/actions/check-set-var-fmt.go b/config-parser/parsers/actions/check-set-var-fmt.go
@@ -50,6 +50,9 @@ func (f *SetVarFmtCheck) Parse(parts []string, parserType types.ParserType, comm
 	data = strings.TrimPrefix(data, "set-var-fmt(")
 	data = strings.TrimRight(data, ")")
 	d := strings.SplitN(data, ".", 2)
+	if len(d) < 2 {
+		return stderrors.New("not enough params")
+	}
 	f.VarScope = d[0]
 	f.VarName = d[1]
 	command, condition := common.SplitRequest(command)
diff --git a/config-parser/parsers/actions/do-resolve.go b/config-parser/parsers/actions/do-resolve.go
@@ -54,6 +54,11 @@ func (f *DoResolve) Parse(parts []string, parserType types.ParserType, comment s
 	}
 	data = strings.TrimPrefix(data, "do-resolve(")
 	data = strings.TrimRight(data, ")")
+	if strings.ContainsAny(data, "\"'") {
+		// An unbalanced quote swallowed following tokens into the name; the
+		// result can't round-trip and grows by ") " on every save.
+		return stderrors.New("not enough params")
+	}
 	d := strings.SplitN(data, ",", 3)
 
 	if len(d) < 2 {
diff --git a/config-parser/parsers/actions/sc-set-gpt.go b/config-parser/parsers/actions/sc-set-gpt.go
@@ -58,6 +58,10 @@ func (f *ScSetGpt) Parse(parts []string, parserType types.ParserType, comment st
 	// sc-get-gpt(sc-id,idx)
 	start := len("sc-set-gpt(")
 	end := len(data) - 1 // ignore ")"
+	if end < start {
+		// e.g. a truncated "sc-set-gpt(" with no "<sc-id>,<idx>)" body.
+		return stderrors.New("missing sc-id and/or idx")
+	}
 	idIdx := strings.Split(data[start:end], ",")
 	if len(idIdx) != 2 {
 		return stderrors.New("missing sc-id and/or idx")
diff --git a/config-parser/parsers/actions/sc_add_gpc.go b/config-parser/parsers/actions/sc_add_gpc.go
@@ -56,6 +56,9 @@ func (f *ScAddGpc) Parse(parts []string, parserType types.ParserType, comment st
 	idIdx := strings.TrimPrefix(data, "sc-add-gpc(")
 	idIdx = strings.TrimRight(idIdx, ")")
 	idIdxValues := strings.SplitN(idIdx, ",", 2)
+	if len(idIdxValues) < 2 {
+		return stderrors.New("not enough params")
+	}
 	f.Idx, f.ID = idIdxValues[0], idIdxValues[1]
 	if len(parts) < minLen {
 		return stderrors.New("not enough params")
diff --git a/config-parser/parsers/actions/sc_inc_gpc.go b/config-parser/parsers/actions/sc_inc_gpc.go
@@ -54,6 +54,9 @@ func (f *ScIncGpc) Parse(parts []string, parserType types.ParserType, comment st
 	idIdx := strings.TrimPrefix(data, "sc-inc-gpc(")
 	idIdx = strings.TrimRight(idIdx, ")")
 	idIdxValues := strings.SplitN(idIdx, ",", 2)
+	if len(idIdxValues) < 2 {
+		return stderrors.New("not enough params")
+	}
 	f.Idx, f.ID = idIdxValues[0], idIdxValues[1]
 	if len(parts) == minLen {
 		return nil
diff --git a/config-parser/parsers/actions/set-bandwidth-limit.go b/config-parser/parsers/actions/set-bandwidth-limit.go
@@ -53,6 +53,9 @@ func (f *SetBandwidthLimit) Parse(parts []string, parserType types.ParserType, c
 		command = parts[3:]
 	}
 	command, condition := common.SplitRequest(command)
+	if len(command) == 0 {
+		return stderrors.New("not enough params")
+	}
 	f.Name = command[0]
 
 	for i := 1; i < len(command); i++ {
diff --git a/config-parser/parsers/actions/set-var-check.go b/config-parser/parsers/actions/set-var-check.go
@@ -50,6 +50,9 @@ func (f *SetVarCheck) Parse(parts []string, parserType types.ParserType, comment
 	data = strings.TrimPrefix(data, "set-var(")
 	data = strings.TrimRight(data, ")")
 	d := strings.SplitN(data, ".", 2)
+	if len(d) < 2 {
+		return stderrors.New("not enough params")
+	}
 	f.VarScope = d[0]
 	f.VarName = d[1]
 	command, condition := common.SplitRequest(command)
diff --git a/config-parser/parsers/actions/set-var-fmt.go b/config-parser/parsers/actions/set-var-fmt.go
@@ -54,7 +54,15 @@ func (f *SetVarFmt) Parse(parts []string, parserType types.ParserType, comment s
 	}
 	data = strings.TrimPrefix(data, "set-var-fmt(")
 	data = strings.TrimRight(data, ")")
+	if strings.ContainsAny(data, "\"'") {
+		// An unbalanced quote swallowed following tokens into the name; the
+		// result can't round-trip and grows by ") " on every save.
+		return stderrors.New("not enough params")
+	}
 	d := strings.SplitN(data, ".", 2)
+	if len(d) < 2 {
+		return stderrors.New("not enough params")
+	}
 	f.VarScope = d[0]
 	f.VarName = d[1]
 	command, condition := common.SplitRequest(command)
diff --git a/config-parser/parsers/actions/set-var.go b/config-parser/parsers/actions/set-var.go
@@ -54,7 +54,15 @@ func (f *SetVar) Parse(parts []string, parserType types.ParserType, comment stri
 	}
 	data = strings.TrimPrefix(data, "set-var(")
 	data = strings.TrimRight(data, ")")
+	if strings.ContainsAny(data, "\"'") {
+		// An unbalanced quote swallowed following tokens into the name; the
+		// result can't round-trip and grows by ") " on every save.
+		return stderrors.New("not enough params")
+	}
 	d := strings.SplitN(data, ".", 2)
+	if len(d) < 2 {
+		return stderrors.New("not enough params")
+	}
 	f.VarScope = d[0]
 	f.VarName = d[1]
 	command, condition := common.SplitRequest(command)
diff --git a/config-parser/parsers/actions/use-service.go b/config-parser/parsers/actions/use-service.go
@@ -37,16 +37,21 @@ func (us *UseService) Parse(parts []string, parserType types.ParserType, comment
 	if comment != "" {
 		us.Comment = comment
 	}
-	if len(parts) < 3 {
-		return errors.New("not enough params")
-	}
 	var data string
 	var command []string
 	switch parserType {
 	case types.HTTP, types.QUIC:
+		if len(parts) < 3 {
+			return errors.New("not enough params")
+		}
 		data = parts[2]
 		command = parts[3:]
 	case types.TCP:
+		// TCP form is "tcp-request content use-service <name>": one token
+		// further right than the HTTP form, so it needs parts[3].
+		if len(parts) < 4 {
+			return errors.New("not enough params")
+		}
 		data = parts[3]
 		command = parts[4:]
 	}
diff --git a/config-parser/parsers/config-snippet.go b/config-parser/parsers/config-snippet.go
@@ -33,7 +33,10 @@ type ConfigSnippet struct {
 func (p *ConfigSnippet) Parse(line string, parts []string, comment string) (string, error) {
 	if comment != "" {
 		commentParts := strings.Fields(comment)
-		if len(commentParts) > 1 || commentParts[0] == "##_config-snippet_###" {
+		// Only a real "##_config-snippet_### BEGIN|END" marker may drive the
+		// switch; require the keyword too so other comments don't reach
+		// commentParts[1] or the BEGIN-only p.data.
+		if len(commentParts) > 1 && commentParts[0] == "##_config-snippet_###" {
 			switch commentParts[1] {
 			case "BEGIN":
 				p.active = true
@@ -42,13 +45,13 @@ func (p *ConfigSnippet) Parse(line string, parts []string, comment string) (stri
 			case "END":
 				p.active = false
 				return "snippet_end", nil
-			default:
-				p.data.Value = append(p.data.Value, strings.TrimSpace(line))
-				return "", nil
 			}
 		}
 	}
 	if p.active {
+		if p.data == nil {
+			p.data = &types.StringSliceC{}
+		}
 		p.data.Value = append(p.data.Value, strings.TrimSpace(line))
 		return "", nil
 	}
diff --git a/config-parser/parsers/extra/section.go b/config-parser/parsers/extra/section.go
@@ -18,6 +18,7 @@ package extra
 
 import (
 	stderrors "errors"
+	"strings"
 
 	"github.com/haproxytech/client-native/v6/config-parser/common"
 	"github.com/haproxytech/client-native/v6/config-parser/errors"
@@ -38,6 +39,12 @@ func (s *Section) Init() {
 func (s *Section) Parse(line string, parts []string, comment string) (string, error) {
 	if parts[0] == s.Name {
 		if len(parts) > 1 {
+			// A section name is one bare token; a quote signals an unbalanced
+			// quote that swallowed following tokens (e.g. a "from <defaults>"
+			// clause), which then can't round-trip.
+			if strings.ContainsAny(parts[1], "\"'") {
+				return "", &errors.ParseError{Parser: "Section", Line: line}
+			}
 			s.data.Name = parts[1]
 		}
 		if len(parts) > 3 && parts[2] == "from" {
diff --git a/config-parser/parsers/http-reuse.go b/config-parser/parsers/http-reuse.go
@@ -29,6 +29,9 @@ type HTTPReuse struct {
 
 func (p *HTTPReuse) Parse(line string, parts []string, comment string) (string, error) {
 	if parts[0] == "http-reuse" {
+		if len(parts) < 2 {
+			return "", &errors.ParseError{Parser: "HTTPReuse", Line: line}
+		}
 		switch parts[1] {
 		case "aggressive", "always", "never", "safe":
 			p.data = &types.HTTPReuse{ShareType: parts[1], Comment: comment}
diff --git a/config-parser/parsers/http/actions/check-send.go b/config-parser/parsers/http/actions/check-send.go
@@ -74,7 +74,7 @@ func (c *CheckSend) Parse(parts []string, parserType types.ParserType, comment s
 		case "hdr":
 			if (i+1) < len(parts) && (i+2) < len(parts) {
 				c.Header = append(c.Header, CheckSendHeader{Name: parts[i+1], Format: parts[i+2]})
-				i++
+				i += 2 // skip <name> and <fmt>; +1 would rescan <fmt> as a keyword
 			}
 		case "body":
 			actions.CheckParsePair(parts, &i, &c.Body)
diff --git a/config-parser/parsers/http/actions/deny.go b/config-parser/parsers/http/actions/deny.go
@@ -37,7 +37,7 @@ type Deny struct { // http-request deny [status <code>] [content-type <type>] [
 	CondTest      string
 }
 
-func (f *Deny) Parse(parts []string, parserType types.ParserType, comment string) error {
+func (f *Deny) Parse(parts []string, parserType types.ParserType, comment string) error { //nolint:gocognit
 	f.Hdrs = []*Hdr{}
 	if comment != "" {
 		f.Comment = comment
@@ -48,16 +48,25 @@ func (f *Deny) Parse(parts []string, parserType types.ParserType, comment string
 			for i := 0; i < len(command); i++ {
 				switch command[i] {
 				case "status", "deny_status":
+					if len(command) < i+2 {
+						return stderrors.New("not enough params")
+					}
 					i++
 					code, err := strconv.ParseInt(command[i], 10, 64)
 					if err != nil {
 						return stderrors.New("failed to parse status code")
 					}
 					f.Status = &code
 				case "content-type":
+					if len(command) < i+2 {
+						return stderrors.New("not enough params")
+					}
 					i++
 					f.ContentType = command[i]
 				case "errorfile", "errorfiles", "file", "lf-file", "string", "lf-string":
+					if len(command) < i+2 {
+						return stderrors.New("not enough params")
+					}
 					f.ContentFormat = command[i]
 					i++
 					f.Content = command[i]
diff --git a/config-parser/parsers/http/actions/return.go b/config-parser/parsers/http/actions/return.go
@@ -81,7 +81,7 @@ func allowedStatusCode(code int64) bool {
 	return code >= 200 && code <= 509
 }
 
-func (f *Return) Parse(parts []string, parserType types.ParserType, comment string) error {
+func (f *Return) Parse(parts []string, parserType types.ParserType, comment string) error { //nolint:gocognit
 	f.Hdrs = []*Hdr{}
 	if comment != "" {
 		f.Comment = comment
@@ -93,17 +93,26 @@ func (f *Return) Parse(parts []string, parserType types.ParserType, comment stri
 				switch command[i] {
 				case "status":
 					i++
+					if i >= len(command) {
+						return stderrors.New("failed to parse status code")
+					}
 					code, err := strconv.ParseInt(command[i], 10, 64)
 					if err != nil {
 						return stderrors.New("failed to parse status code")
 					}
 					f.Status = &code
 				case "content-type":
 					i++
+					if i >= len(command) {
+						return stderrors.New("failed to parse content-type")
+					}
 					f.ContentType = command[i]
 				case "errorfile", "errorfiles", "file", "lf-file", "string", "lf-string":
 					f.ContentFormat = command[i]
 					i++
+					if i >= len(command) {
+						return stderrors.New("failed to parse content")
+					}
 					f.Content = command[i]
 				case "default-errorfiles":
 					f.ContentFormat = command[i]
diff --git a/config-parser/parsers/http/actions/status.go b/config-parser/parsers/http/actions/status.go
@@ -91,10 +91,16 @@ func (f *Status) Parse(parts []string, parserType types.ParserType, comment stri
 			switch command[i] {
 			case "content-type":
 				i++
+				if i >= len(command) {
+					return stderrors.New("failed to parse content-type")
+				}
 				f.ContentType = command[i]
 			case "errorfile", "errorfiles", "file", "lf-file", "string", "lf-string":
 				f.ContentFormat = command[i]
 				i++
+				if i >= len(command) {
+					return stderrors.New("failed to parse content")
+				}
 				f.Content = command[i]
 			case "default-errorfiles":
 				f.ContentFormat = command[i]
diff --git a/config-parser/parsers/http/actions/tarpit.go b/config-parser/parsers/http/actions/tarpit.go
@@ -38,7 +38,7 @@ type Tarpit struct { // http-request deny [status <code>] [content-type <type>]
 	CondTest      string
 }
 
-func (f *Tarpit) Parse(parts []string, parserType types.ParserType, comment string) error { //nolint:dupl
+func (f *Tarpit) Parse(parts []string, parserType types.ParserType, comment string) error { //nolint:dupl,gocognit
 	f.Hdrs = []*Hdr{}
 	if comment != "" {
 		f.Comment = comment
@@ -50,17 +50,26 @@ func (f *Tarpit) Parse(parts []string, parserType types.ParserType, comment stri
 				switch command[i] {
 				case "status", "deny_status":
 					i++
+					if i >= len(command) {
+						return stderrors.New("failed to parse status code")
+					}
 					code, err := strconv.ParseInt(command[i], 10, 64)
 					if err != nil {
 						return stderrors.New("failed to parse status code")
 					}
 					f.Status = &code
 				case "content-type":
 					i++
+					if i >= len(command) {
+						return stderrors.New("failed to parse content-type")
+					}
 					f.ContentType = command[i]
 				case "errorfile", "errorfiles", "file", "lf-file", "string", "lf-string":
 					f.ContentFormat = command[i]
 					i++
+					if i >= len(command) {
+						return stderrors.New("failed to parse content")
+					}
 					f.Content = command[i]
 				case "default-errorfiles":
 					f.ContentFormat = command[i]
diff --git a/config-parser/parsers/on-log-step.go b/config-parser/parsers/on-log-step.go
@@ -79,6 +79,11 @@ func (o *OnLogStep) parse(line string, parts []string, comment string) (*types.O
 	}
 
 	for {
+		// Each keyword needs a value; an odd trailing token (a lone
+		// format/sd) would otherwise read parts[1] out of range.
+		if len(parts) < 2 {
+			return nil, &errors.ParseError{Parser: on, Line: line, Message: "Parse error: bad trailing argument"}
+		}
 		switch parts[0] {
 		case "format":
 			step.Format = parts[1]
diff --git a/config-parser/parsers/option-http-restrict-req-hdr-names.go b/config-parser/parsers/option-http-restrict-req-hdr-names.go
@@ -31,10 +31,11 @@ func (o *OptionHTTPRestrictReqHdrNames) Parse(line string, parts []string, comme
 	if len(parts) != 3 {
 		return "", &errors.ParseError{Parser: "option http-restrict-req-hdr-names", Line: line}
 	}
-	o.data = &types.OptionHTTPRestrictReqHdrNames{Comment: comment}
+	// Set data only on a valid policy: a non-nil data after an error return
+	// would make Result() emit a spurious line.
 	switch parts[2] {
 	case "preserve", "delete", "reject":
-		o.data.Policy = parts[2]
+		o.data = &types.OptionHTTPRestrictReqHdrNames{Comment: comment, Policy: parts[2]}
 	default:
 		return "", &errors.ParseError{Parser: "option http-restrict-req-hdr-names", Line: line}
 	}
diff --git a/config-parser/parsers/simple/array-string-kv.go b/config-parser/parsers/simple/array-string-kv.go
@@ -31,6 +31,9 @@ type ArrayKeyValue struct {
 
 func (p *ArrayKeyValue) Parse(line string, parts []string, comment string) (string, error) {
 	if parts[0] == p.Name {
+		if len(parts) < 3 {
+			return "", &errors.ParseError{Parser: "ArrayKeyValue", Line: line}
+		}
 		p.data = append(p.data, types.StringKeyValueC{
 			Key:     parts[1],
 			Value:   parts[2],
diff --git a/config-parser/parsers/stick.go b/config-parser/parsers/stick.go
@@ -32,6 +32,10 @@ type Stick struct {
 func (h *Stick) Parse(line string, parts []string, comment string) (string, error) {
 	if len(parts) >= 2 && parts[0] == "stick" {
 		command, condition := common.SplitRequest(parts[2:])
+		if len(command) == 0 {
+			// "stick <type>" with no pattern: nothing to match on.
+			return "", &errors.ParseError{Parser: "Stick", Line: line}
+		}
 		data := types.Stick{
 			Pattern: command[0],
 			Comment: comment,
diff --git a/config-parser/parsers/tcp/actions/capture.go b/config-parser/parsers/tcp/actions/capture.go
diff --git a/config-parser/parsers/tcp/types/connection.go b/config-parser/parsers/tcp/types/connection.go
diff --git a/config-parser/parsers/tcp/types/inspect-delay.go b/config-parser/parsers/tcp/types/inspect-delay.go
diff --git a/config-parser/parsers/tcp/types/session.go b/config-parser/parsers/tcp/types/session.go
diff --git a/config-parser/reader.go b/config-parser/reader.go

Original file line number	Diff line number	Diff line change
`@@ -53,6 +53,9 @@ func (f *SetBandwidthLimit) Parse(parts []string, parserType types.ParserType, c`
`53`	`53`	`command = parts[3:]`
`54`	`54`	`}`
`55`	`55`	`command, condition := common.SplitRequest(command)`
	`56`	`+ if len(command) == 0 {`
	`57`	`+ return stderrors.New("not enough params")`
	`58`	`+ }`
`56`	`59`	`f.Name = command[0]`
`57`	`60`
`58`	`61`	`for i := 1; i < len(command); i++ {`