Fix cmd match stringy

[RollerMatic]

This PR fixes the regex matching algorithm in tacquito's default authorizer by adding boundary conditions around the contents of the match attribute of commands.

[RollerMatic]

Checks

Tests pass

~/github/tacquito ❯  go test
PASS
ok      github.com/facebookincubator/tacquito   2.048s

Functional testing

before

> ./client -mode authz  --username cisco --cmd "bash /dev/console/file_contains_ls.sh"
2024/10/15 13:16:14 executing static password mode
(*tacquito.AuthorReply)(0xc0000fd9c0)({
 Status: (tacquito.AuthorStatus) AuthorStatusPassAdd,
 Args: (tacquito.Args) ,
 ServerMsg: (tacquito.AuthorServerMsg) (len=22) authorization approved,
 Data: (tacquito.AuthorData)
})

after

expected to deny: command does not match patterns allowed for the user

❯ ./client -mode authz  --username cisco --cmd "bash /dev/console/file_contains_ls.sh"
2024/10/15 12:52:34 executing static password mode
2024/10/15 12:52:35 FAILED: args [service=shell, cmd=bash, cmd-arg=/dev/console/file_contains_ls.sh, cmd-arg=<cr>, ]; expected a [AuthorStatusPassAdd] but got a [AuthorStatusFail]
(*tacquito.AuthorReply)(0xc0000ff3c0)({
 Status: (tacquito.AuthorStatus) AuthorStatusFail,
 Args: (tacquito.Args) ,
 ServerMsg: (tacquito.AuthorServerMsg) (len=14) not authorized,
 Data: (tacquito.AuthorData)
})

expected to pass: "cisco" user can run commands that match regex ls.*

❯ ./client -mode authz  --username cisco --cmd "bash ls /dev/console"
2024/10/15 12:52:45 executing static password mode
(*tacquito.AuthorReply)(0xc00078ccc0)({
 Status: (tacquito.AuthorStatus) AuthorStatusPassAdd,
 Args: (tacquito.Args) ,
 ServerMsg: (tacquito.AuthorServerMsg) ,
 Data: (tacquito.AuthorData)
})

[facebook-github-bot]

@RollerMatic has imported this pull request. If you are a Meta employee, you can view this diff on Phabricator.

[facebook-github-bot]

@RollerMatic has imported this pull request. If you are a Meta employee, you can view this diff on Phabricator.

[facebook-github-bot]

@RollerMatic has imported this pull request. If you are a Meta employee, you can view this diff on Phabricator.