From 5de4b4d39b943937e971cf7dde75bcff4b3e20a1 Mon Sep 17 00:00:00 2001 From: Armaan Sandhu Date: Tue, 20 Oct 2026 19:45:17 -0400 Subject: [PATCH] toke.l: check the whole argument regex in strict mode When a command's arguments are a regular expression (^...$), the GOTREGEX "$" rule validated sudoerstext in strict mode, which at that point is only the "$" that was just matched, not the expression collected in sudoerslval.command.args. As a result, visudo -c accepted invalid argument regexes such as "/bin/ls ^[a-z$", while the same mistake in a command path regex was reported. Compile the accumulated arguments instead. --- plugins/sudoers/toke.c | 2 +- plugins/sudoers/toke.l | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/sudoers/toke.c b/plugins/sudoers/toke.c index a0307d3749..544fdfe88b 100644 --- a/plugins/sudoers/toke.c +++ b/plugins/sudoers/toke.c @@ -3882,7 +3882,7 @@ YY_RULE_SETUP BEGIN INITIAL; continued = false; if (sudoers_strict()) { - if (!sudo_regex_compile(NULL, sudoerstext, + if (!sudo_regex_compile(NULL, sudoerslval.command.args, &sudoers_errstr)) { LEXTRACE("ERROR "); return ERROR; diff --git a/plugins/sudoers/toke.l b/plugins/sudoers/toke.l index a98e6db5db..250fea7e8c 100644 --- a/plugins/sudoers/toke.l +++ b/plugins/sudoers/toke.l @@ -305,7 +305,7 @@ DEFVAR [a-z_]+ BEGIN INITIAL; continued = false; if (sudoers_strict()) { - if (!sudo_regex_compile(NULL, sudoerstext, + if (!sudo_regex_compile(NULL, sudoerslval.command.args, &sudoers_errstr)) { LEXTRACE("ERROR "); return ERROR;