add and use FR_VALUE_BOX_SAFE_FOR_ANY

which lets us *not* escape data which is taken from the
configuration files

This branch should be deleted when the work is merged to the
master branch

Author: alandekok

src/lib/server/cf_parse.c

@@ -225,7 +225,8 @@ int cf_pair_parse_value(TALLOC_CTX *ctx, void *out, UNUSED void *base, CONF_ITEM
 							.allow_unknown = true,
 							.allow_unresolved = true,
 							.allow_foreign = true,
-						}
+						},
+						.literals_safe_for = FR_VALUE_BOX_SAFE_FOR_ANY,
 					};
 		fr_sbuff_t		sbuff = FR_SBUFF_IN(cp->value, strlen(cp->value));
 

src/lib/server/virtual_servers.c

@@ -1619,6 +1619,8 @@ int virtual_servers_instantiate(void)
 					.dict_def = dict,
 					.list_def = request_attr_request,
 				},
+
+				.literals_safe_for = FR_VALUE_BOX_SAFE_FOR_ANY,
 			};
 
 			fr_assert(parse_rules.attr.dict_def != NULL);

src/lib/unlang/xlat_builtin.c

@@ -758,6 +758,7 @@ static xlat_action_t xlat_func_taint(UNUSED TALLOC_CTX *ctx, fr_dcursor_t *out,
 
 		while ((child = fr_value_box_list_pop_head(&vb->vb_group)) != NULL) {
 			child->tainted = true;
+			fr_value_box_mark_unsafe(child);
 
 			fr_dcursor_append(out, child);
 		}

src/lib/util/value.c

@@ -6358,7 +6358,16 @@ void fr_value_box_list_verify(char const *file, int line, fr_value_box_list_t co
  */
 void _fr_value_box_mark_safe_for(fr_value_box_t *vb, fr_value_box_safe_for_t safe_for)
 {
+	/*
+	 *	Don't over-ride value-boxes which are already safe.
+	 */
+	if (vb->safe_for == FR_VALUE_BOX_SAFE_FOR_ANY) {
+		fr_assert(!vb->tainted);
+		return;
+	}
+
 	vb->safe_for = safe_for;
+	vb->tainted = false;
 }
 
 /** Mark a value-box as "unsafe"
@@ -6379,7 +6388,18 @@ void fr_value_box_mark_unsafe(fr_value_box_t *vb)
  */
 void fr_value_box_list_mark_safe_for(fr_value_box_list_t *list, fr_value_box_safe_for_t safe_for)
 {
-	fr_value_box_list_foreach(list, vb) vb->safe_for = safe_for;
+	fr_value_box_list_foreach(list, vb) {
+		/*
+		 *	Don't over-ride value-boxes which are already safe.
+		 */
+		if (vb->safe_for == FR_VALUE_BOX_SAFE_FOR_ANY) {
+			fr_assert(!vb->tainted);
+
+		} else {
+			vb->safe_for = safe_for;
+			vb->tainted = false;
+		}
+	}
 }
 
 /** Check truthiness of values.

src/lib/util/value.h

@@ -154,6 +154,9 @@ typedef union {
  */
 typedef uintptr_t fr_value_box_safe_for_t;
 
+#define FR_VALUE_BOX_SAFE_FOR_NONE ((uintptr_t) 0)
+#define FR_VALUE_BOX_SAFE_FOR_ANY (~((uintptr_t) 0))
+
 /** Union containing all data types supported by the server
  *
  * This union contains all data types that can be represented by fr_pair_ts. It may also be used in other parts
@@ -1052,7 +1055,7 @@ void		_fr_value_box_mark_safe_for(fr_value_box_t *box, fr_value_box_safe_for_t s
 void		fr_value_box_mark_unsafe(fr_value_box_t *box)
 		CC_HINT(nonnull);
 
-#define		fr_value_box_is_safe_for(_box, _safe_for) (_box->safe_for == (fr_value_box_safe_for_t)_safe_for)
+#define		fr_value_box_is_safe_for(_box, _safe_for) ((_box->safe_for == (fr_value_box_safe_for_t)_safe_for) || (_box->safe_for == FR_VALUE_BOX_SAFE_FOR_ANY))
 
 void		fr_value_box_list_mark_safe_for(fr_value_box_list_t *list, fr_value_box_safe_for_t safe_for);
 

src/tests/keywords/regex-escape

@@ -8,7 +8,7 @@ string test_string2
 #  Strings which are expanded in a regex have regex special
 #  characters escaped.  Because the input strings are unsafe.
 #
-test_string1 := "example.com"
+test_string1 := %taint("example.com")
 test_string2 := "exampleXcom"
 
 if ("exampleXcom" =~ /%{test_string1}/) {