Skip to content

hrw4u: Fix u4wrh raw %{...} passthrough for unresolved HRW variables - #13206

Open
Clendenin wants to merge 2 commits into
apache:masterfrom
Clendenin:bugfix/u4wrh-raw-pct
Open

Clendenin wants to merge 2 commits into
apache:masterfrom
Clendenin:bugfix/u4wrh-raw-pct

Conversation

@Clendenin

@Clendenin Clendenin commented May 27, 2026

Copy link
Copy Markdown
Contributor

Summary

The reverse symbol resolver silently swallowed SymbolResolutionError in the
visitor cache and emitted raw HRW percent tags into HRW4U output, producing
syntax that hrw4u then failed to re-parse.

This change adds the missing reverse mappings for bare CLIENT-URL and
CLIENT-CERT:APRN-RAW, and surfaces unmapped tags as explicit errors rather
than invalid output so future gaps cannot hide. BARE_TAG_MAP is registered
through REVERSE_RESOLUTION_MAP so every reverse table has a single source of
truth.

@Clendenin
Clendenin force-pushed the bugfix/u4wrh-raw-pct branch from 8c15e89 to 6f45102 Compare May 27, 2026 23:21
@zwoop
zwoop requested review from Copilot and zwoop May 29, 2026 17:14
@zwoop zwoop added the hrw4u label May 29, 2026
@zwoop zwoop added this to the 11.0.0 milestone May 29, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR improves HRW4U reverse conversion for legacy raw HRW percent tags by adding missing reverse mappings and tests for u4wrh round-trip validity.

Changes:

  • Adds reverse mapping support for bare CLIENT-URL and legacy bare CLIENT-CERT tags.
  • Registers BARE_TAG_MAP in the generated reverse resolution map.
  • Adds fixtures and a round-trip test to ensure u4wrh output does not contain raw %{...} tags for covered legacy cases.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
tools/hrw4u/src/types.py Allows APRN-RAW as a certificate suffix.
tools/hrw4u/src/tables.py Adds fallback and bare-tag reverse mappings.
tools/hrw4u/src/generators.py Includes bare-tag mappings in reverse resolution generation.
tools/hrw4u/src/hrw_symbols.py Resolves bare percent tags through BARE_TAG_MAP.
tools/hrw4u/src/hrw_visitor.py Stops swallowing symbol resolution errors in cached condition resolution.
tools/hrw4u/tests/test_u4wrh_round_trip.py Adds round-trip validation for selected legacy bare HRW tags.
tools/hrw4u/tests/data/conds/exceptions.txt Marks new fixtures as reverse-only expectations.
tools/hrw4u/tests/data/conds/bare-client-url.*.txt Adds bare CLIENT-URL reverse fixture.
tools/hrw4u/tests/data/conds/bare-client-cert-aprn.*.txt Adds bare CLIENT-CERT:APRN-RAW reverse fixture.
tools/hrw4u/tests/data/conds/bare-client-cert-san-dns.*.txt Adds bare multi-colon CLIENT-CERT:SAN:DNS reverse fixture.

Comment on lines +69 to +72
def _cached_symbol_to_ident(self, pct_text: str, section_name: str) -> tuple[str, bool]:
"""Cache expensive symbol resolution operations."""
try:
section = SectionType(section_name)
return self.symbol_resolver.percent_to_ident_or_func(pct_text, section)
except (ValueError, SymbolResolutionError):
return pct_text, ""
section = SectionType(section_name)
return self.symbol_resolver.percent_to_ident_or_func(pct_text, section)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Clendenin This has to be addressed.

@zwoop zwoop left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Needs a little work, cleaning up the tests, and addressing the Copilot issue.

The reverse symbol resolver silently swallowed SymbolResolutionError in the
visitor cache and emitted raw HRW percent tags into HRW4U output, producing
syntax that hrw4u then failed to re-parse. Add the missing reverse mappings
for bare CLIENT-URL and CLIENT-CERT:APRN-RAW, and surface unmapped tags as
explicit errors rather than invalid output so future gaps cannot hide.

Registers BARE_TAG_MAP through REVERSE_RESOLUTION_MAP so every reverse table
has a single source of truth.
…tures

Extends the u4wrh reverse-resolution error handling to cover the
operator-argument path (set-header value strings and similar). The
inline percent-rewriting helpers in InverseSymbolResolver previously
swallowed SymbolResolutionError and emitted raw %{...} text into the
HRW4U output, defeating the fix already applied on the condition path.
The error now propagates through the visitor's existing trap() into
the ErrorCollector, matching the condition path.

Also removes APRN-RAW references and the bare-client-cert-aprn
test fixture, which are Apple-internal and not applicable upstream.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants