Merge branch 'security-300265-13-18' into '13-18-stable'v13.18.113-18-stable

Modify regex to prevent partial matches

See merge request gitlab-org/security/gitlab-shell!8

4 files changed, 14 insertions, 5 deletions

diff --git a/CHANGELOG b/CHANGELOG
index 27bf34a..83e1769 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,7 @@
+v13.18.1
+
+- Modify regex to prevent partial matches
+
 v13.18.0
 
 - Fix thread-safety issues in gitlab-shell !463
diff --git a/VERSION b/VERSION
index ce0b279..41ea3a8 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-13.18.0
+13.18.1
diff --git a/internal/command/commandargs/command_args_test.go b/internal/command/commandargs/command_args_test.go
index 0329c82..7b9f0ad 100644
--- a/internal/command/commandargs/command_args_test.go
+++ b/internal/command/commandargs/command_args_test.go
@@ -23,14 +23,19 @@ func TestParseSuccess(t *testing.T) {
 			env:          sshenv.Env{IsSSHConnection: true, RemoteAddr: "1"},
 			arguments:    []string{},
 			expectedArgs: &Shell{Arguments: []string{}, SshArgs: []string{}, CommandType: Discover, Env: sshenv.Env{IsSSHConnection: true, RemoteAddr: "1"}},
-		},
-		{
+		}, {
 			desc:         "It finds the key id in any passed arguments",
 			executable:   &executable.Executable{Name: executable.GitlabShell},
 			env:          sshenv.Env{IsSSHConnection: true, RemoteAddr: "1"},
 			arguments:    []string{"hello", "key-123"},
 			expectedArgs: &Shell{Arguments: []string{"hello", "key-123"}, SshArgs: []string{}, CommandType: Discover, GitlabKeyId: "123", Env: sshenv.Env{IsSSHConnection: true, RemoteAddr: "1"}},
 		}, {
+			desc:         "It finds the key id only if the argument is of <key-id> format",
+			executable:   &executable.Executable{Name: executable.GitlabShell},
+			env:          sshenv.Env{IsSSHConnection: true, RemoteAddr: "1"},
+			arguments:    []string{"hello", "username-key-123"},
+			expectedArgs: &Shell{Arguments: []string{"hello", "username-key-123"}, SshArgs: []string{}, CommandType: Discover, GitlabUsername: "key-123", Env: sshenv.Env{IsSSHConnection: true, RemoteAddr: "1"}},
+		}, {
 			desc:         "It finds the username in any passed arguments",
 			executable:   &executable.Executable{Name: executable.GitlabShell},
 			env:          sshenv.Env{IsSSHConnection: true, RemoteAddr: "1"},
diff --git a/internal/command/commandargs/shell.go b/internal/command/commandargs/shell.go
index 9cf6720..589f58d 100644
--- a/internal/command/commandargs/shell.go
+++ b/internal/command/commandargs/shell.go
@@ -20,8 +20,8 @@ const (
 )
 
 var (
-	whoKeyRegex      = regexp.MustCompile(`\bkey-(?P<keyid>\d+)\b`)
-	whoUsernameRegex = regexp.MustCompile(`\busername-(?P<username>\S+)\b`)
+	whoKeyRegex      = regexp.MustCompile(`\Akey-(?P<keyid>\d+)\z`)
+	whoUsernameRegex = regexp.MustCompile(`\Ausername-(?P<username>\S+)\z`)
 )
 
 type Shell struct {