fix: match content.body push rules on word boundaries#234
Merged
Conversation
A content.body event_match (and the content keyword-highlight rules) matched the whole body value, so a bare keyword rule only fired when the message equalled the keyword — keyword and mention notifications almost never worked. Per spec, content.body matches a substring delimited by word boundaries: `alice` now fires on "hi alice" but not "malice". Literal keywords use a whole-word search; glob patterns compile to a word-boundary-anchored, linear-time regex (ReDoS-safe). An absent or non-string body never matches, even for `*`.
smoketest-rs has its own --locked Cargo.lock; adding regex to vela-core left it stale. Add the dependency edge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A
content.bodyevent_match— and thecontentkeyword-highlight rules — matched against the whole body value via the whole-value glob matcher. So a bare keyword rule (pattern: "alice") only fired when the message body equalled "alice"; keyword and mention notifications essentially never worked in a sentence.Per spec,
content.bodyis a special case: the pattern must match a substring that starts and ends at a word boundary (the start/end of the body, or any character outside[A-Za-z0-9_]— ASCII, per the spec). Soalicenow fires on "hi alice" but not "malice" or "aliceb".*/?) use the existing whole-word search — no regex.regexcrate is linear-time (RE2-style), so an attacker-set push-rule pattern can't cause catastrophic backtracking on the synchronous/synceval path.*(spec), in both theevent_matchandcontent-kind paths.*keyword*"contains" rules still match (the outer stars reach the string-end boundaries); the change is a strict superset of what matched before.Adds
regexas a vela-core dependency (already a workspace dep). Tests cover word boundaries, glob patterns,?, escaped metacharacters, the*keyword*idiom, absent/non-string body, and the keyword-highlight path.