Skip to content

[Bug]: Complex regex issue on node definition #359

@ltning

Description

@ltning

Is this a critical security issue?

  • This is not a security issue.

Describe the Bug

This is the same issue as in the (old) Puppetlabs server:
puppetlabs/puppet#9483

Basically, our moderately complex node definition regexes fail with current openvox-server, for example:
node /^(db01)\.(?!hosts).*$/ {

The match fails in a way that simply causes the node not to be found.

A patch exists; see below.

Expected Behavior

The node should be found.

Steps to Reproduce

Use a complex regex to match node names, possibly with negative lookaheads.

Environment

Version openvox-server8-8.12.1_1, openvox-agent8-8.25.0
Platform FreeBSD 15

NOTE: While the file in question is from the agent, the problem only manifests and only needs to be patched on the server instance.

NOTE 2: An issue since puppetserver 8.x and in all versions of openvox-server/agent.

Additional Context

The following patch reverses the original commit which caused the issue:

--- /usr/local/lib/ruby/site_ruby/3.4/puppet/resource/type.rb.orig      2026-02-17 06:59:38.000000000 +0000
+++ /usr/local/lib/ruby/site_ruby/3.4/puppet/resource/type.rb   2026-05-29 11:30:54.123728000 +0000
@@ -32,16 +32,6 @@
   NODES = 'nodes'
   DOUBLE_COLON = '::'
   EMPTY_ARRAY = [].freeze
-
-  LOOKAROUND_OPERATORS = {
-    "(" => 'LP',
-    "?" => "QU",
-    "<" => "LT",
-    ">" => "GT",
-    "!" => "EX",
-    "=" => "EQ",
-    ")" => 'RP'
-  }.freeze
 
   attr_accessor :file, :line, :doc, :code, :parent, :resource_type_collection, :override
   attr_reader :namespace, :arguments, :behaves_like, :module_name
@@ -206,11 +196,7 @@
 
   def name
     if type == :node && name_is_regex?
-      # Normalize lookarround regex patthern
-      internal_name = @name.source.downcase.gsub(/\(\?[^)]*\)/) do |str|
-        str.gsub(/./) { |ch| LOOKAROUND_OPERATORS[ch] || ch }
-      end
-      "__node_regexp__#{internal_name.gsub(/[^-\w:.]/, '').sub(/^\.+/, '')}"
+      "__node_regexp__#{@name.source.downcase.gsub(/[^-\w:.]/, '').sub(/^\.+/, '')}"
     else
       @name
     end

Relevant log output

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingduplicateThis issue or pull request already exists

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions