fix: Repair three fatal defects in the cacti, wmdata and rrd datasources - #244
Merged
Merged
Conversation
string_or_null() is called in the cacti and wmdata sources but is defined nowhere in the plugin or in Cacti core, so every cacti: target read ended in a fatal Error; the surrounding files already use an inline null check, so these now match. wmdata carried a target regex with no closing delimiter, which left $datafile unset and made file_exists() a TypeError under that file's strict_types, opened $targetstring instead of $datafile, and never closed the handle. The rrd_options guard used '/["\'\\]/', which PCRE reads as an unterminated character class, so preg_match() returned false and the check never rejected anything; it is now one strpbrk() predicate shared by both call sites. Options were escaped with cacti_escapeshellarg() either way, so no injection was reachable through the dead guard. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
TheWitness
approved these changes
Aug 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three defects that stop a datasource dead, all reachable from a normal poller
run. Each is covered by a test that fails without the change.
string_or_null()is called in the cacti and wmdata datasources and definednowhere in the plugin or in Cacti, so every
cacti:target read ended inError: Call to undefined function. The surrounding datasources already usean inline null check; these now match.
wmdata:target regex had no closing delimiter.preg_match()returnedfalse,
$datafilestayed unset, andfile_exists()raised a TypeError underthat file's
strict_types. The same method also opened$targetstringrather than
$datafileand never closed the handle.'/["\'\\]/', which PCRE reads as an unterminatedcharacter class, so
preg_match()returned false and the check neverrejected anything. It is now one
strpbrk()predicate shared by both callsites. Options were passed through
cacti_escapeshellarg()either way, sonothing was injectable through the dead guard.
Verification: 130 passed on 8.1, 8.3 and 8.4.
Second of seven; needs #1.