logger matchPattern missing length guard causes false positives with overlapping prefix/suffix wildcards #28978

Problem

matchPattern in pkg/logger/logger.go handles middle-wildcard patterns (e.g. "a*b") by splitting on * and checking HasPrefix + HasSuffix. However, it does not verify that the namespace string is long enough to contain both the prefix and suffix without overlap.

Location

pkg/logger/logger.go:200–209

// Middle wildcard: split and check both parts
parts := strings.SplitN(pattern, "*", 2)
if len(parts) == 2 {
    prefix := parts[0]
    suffix := parts[1]
    return strings.HasPrefix(namespace, prefix) && strings.HasSuffix(namespace, suffix)
    // ↑ missing: len(namespace) >= len(prefix)+len(suffix)
}

Reproducer

Pattern "ab*ba" applied to namespace "aba" (3 chars, but prefix + suffix require 4):

• strings.HasPrefix("aba", "ab") → true
• strings.HasSuffix("aba", "ba") → true
• Result: incorrectly returns true (false positive match)

In practice the codebase uses namespaces of the form "package:subpackage" and patterns like "package:*", so this edge case is unlikely to trigger in production. However the bug is a latent correctness defect.

Impact

• Severity: Medium (latent, unlikely to trigger with current namespace conventions)
• Incorrect logger enablement could expose debug output for a namespace that was not intended to be enabled

Recommendation

Add a length guard before the prefix/suffix check:

parts := strings.SplitN(pattern, "*", 2)
if len(parts) == 2 {
    prefix, suffix := parts[0], parts[1]
    return len(namespace) >= len(prefix)+len(suffix) &&
        strings.HasPrefix(namespace, prefix) &&
        strings.HasSuffix(namespace, suffix)
}

Validation

• go test ./pkg/logger/... passes
• Add a table-driven test covering overlapping prefix/suffix cases

Estimated Effort

Small

Generated by Sergo - Serena Go Expert · ● 462.3K · ◷

• expires on May 5, 2026, 8:52 PM UTC