Problem with block-user-agents and commas in UA string

[b2cc]

We are using ingress-nginx, deployed via helm on an Openshift 4.19 cluster:

NAME                                    NAMESPACE                                       REVISION        UPDATED                                         STATUS          CHART                                APP VERSION  
ingress-nginx                           ingress-nginx                                   19              2025-09-01 16:52:20.809739161 +0200 CEST        deployed        ingress-nginx-4.13.1                 1.13.1

Our values.yaml defines the config map as follows:

  config:
    block-user-agents: |
      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"

I would have expected the UA string to turn up in the nginx config exactly as I have specified it in the YAML, since it being double-quoted and all.

However, in the generated nginx.conf this turns into two lines, separated at the spot where the , is placed in the user agent:

      map $http_user_agent $block_ua {
                default 0;
                "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML 1;
                like Gecko) Chrome/112.0.0.0 Safari/537.36" 1;
      }

user agent:

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
                                                                   ^

I tried to escape the , or use different YAML quote techniqes, but nothing seemed to work - the UA string always ended up as two separate lines in the config. Is there a way how to escape this correctly, or is this a bug?

Thanks for your support!

[k8s-ci-robot]

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[b2cc]

PS: as a workaround I have used a regex for now, replacing the , with a . to just match any character, which seems to work.

"~*Mozilla/5\.0 \(Windows NT 10\.0; Win64; x64\) AppleWebKit/537\.36 \(KHTML. like Gecko\) Chrome/112\.0\.0\.0 Safari/537\.36"
                                                                            ^