Update V1 Parser to Check for Duplicates

[sarahalsmiller]

There was a consul security finding where when parsing in an ACL object using the V1 parser that looked like the following

acl = "read"
acl= "write"

The decoder would only only return the last value in the list, causing a potential for accidental privilege escalation. This is a known issue with V1 and has been resolved in V2, however, because the APIs are incompatible and consul has many structs already using the V1 syntax, it didn't seem practical to do a hard shift to V2 HCL at this time. This PR should fix the issue in V1 and add additional test cases.

[GreenLantern16]

Can you unsubscribe ***@***.*** from this list? He is no longer at HashiCorp.

…

On Mon, Oct 28, 2024 at 2:31 PM 'sarahalsmiller' via Departed - Greg Thomas ***@***.***> wrote: There was a consul security finding where when parsing in an ACL object using the V1 parser that looked like the following acl = "read" acl= "write" The decoder would only only return the last value in the list, causing a potential for accidental privilege escalation. This is a known issue with V1 and has been resolved in V2, however, because the APIs are incompatible and consul has many structs already using the V1 syntax, it didn't seem practical to do a hard shift to V2 HCL at this time. This PR should fix the issue in V1 and add additional test cases. ------------------------------ You can view, comment on, or merge this pull request online at: #704 Commit Summary - b8bc938 <b8bc938> update parser to check for duplicates - 203eb20 <203eb20> add additional test cases and ensure they still work File Changes (3 files <https://github.com/hashicorp/hcl/pull/704/files>) - *M* hcl/parser/parser.go <https://github.com/hashicorp/hcl/pull/704/files#diff-49666642eebfd553ca5f67d1495728bf86e498bd14a10f231b739cb5f40f6741> (26) - *M* hcl/parser/parser_test.go <https://github.com/hashicorp/hcl/pull/704/files#diff-5eca77f616c9b44732b4ad56c8158155833d53d0df52b1b2762d00d9a98a1acb> (49) - *M* hcl/parser/test-fixtures/types.hcl <https://github.com/hashicorp/hcl/pull/704/files#diff-459368fcec858d6b0ba4c257cf3347be6aa26521057517d88b755e0d082be014> (8) Patch Links: - https://github.com/hashicorp/hcl/pull/704.patch - https://github.com/hashicorp/hcl/pull/704.diff — Reply to this email directly, view it on GitHub <#704>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AVDWF7XXZY2LWQM3JLS2SJTZ5Z7I7AVCNFSM6AAAAABQYBYMB2VHI2DSMVQWIX3LMV43ASLTON2WKOZSGYYTSMRQGIZDAMI> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[NiniOak]

Tested locally and works to remove duplicate acl configuration. Thanks @sarahalsmiller

[finnigja]

Can you unsubscribe @.*** from this list? He is no longer at HashiCorp.

We can't control your GitHub email notification settings, @GreenLantern16. I think if you hit the unsubscribe link at the bottom of the email you received, that should take care of it.

[GreenLantern16]

Thanks for the response. @GreenLantern16 <https://github.com/GreenLantern16> left HashiCorp last spring. I receive all of his emails. I will attempt to contact him about this.

…

On Tue, Oct 29, 2024 at 6:41 PM 'Jamie Finnigan' via Departed - Greg Thomas ***@***.***> wrote: Can you unsubscribe *@*.*** from this list? He is no longer at HashiCorp. We can't control your GitHub email notification settings, @GreenLantern16 <https://github.com/GreenLantern16>. I think if you hit the unsubscribe link at the bottom of the email you received, that should take care of it. — Reply to this email directly, view it on GitHub <#704 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AVDWF7RQBNVJX3QLHCU4XWLZ6AFIHAVCNFSM6AAAAABQYBYMB2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINBVGQ2TMNJUGU> . You are receiving this because you were mentioned.Message ID: ***@***.***>