[GH-ISSUE #840] Topic Pattern *_ matches everything #592

New issue

Closed

opened 2026-05-07 00:25:40 +02:00 by BreizhHardware · 4 comments

BreizhHardware commented

2026-05-07 00:25:40 +02:00

Owner

Originally created by @Joe-0237 on GitHub (Aug 18, 2023).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/840

🐞 Describe the bug
Any ACL Topic Pattern containing only underscores and stars _ * matches all topics: eg.
_*, *_, _*_*_, __*__, _*_

💻 Components impacted
Server

🔮 Additional context
To reproduce:
with the default permission set to read-write
as an anonymous user
deny access to everyone for *_ ntfy access everyone *_ deny
attempt to subscribe to test

Originally created by @Joe-0237 on GitHub (Aug 18, 2023). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/840 :lady_beetle: **Describe the bug** Any ACL Topic Pattern containing only underscores and stars _ * matches all topics: eg. `_*`, `*_`, `_*_*_`, `__*__`, `_*_` :computer: **Components impacted** Server :crystal_ball: **Additional context** **To reproduce:** with the default permission set to read-write as an anonymous user deny access to everyone for *_ `ntfy access everyone *_ deny` attempt to subscribe to `test`

BreizhHardware

2026-05-07 00:25:40 +02:00

closed this issue
added the
🪲 bug
label

BreizhHardware commented

2026-05-07 00:25:41 +02:00

Author

Owner

@binwiederhier commented on GitHub (Aug 18, 2023):

I see. Good catch!

@binwiederhier commented on GitHub (Aug 18, 2023): I see. Good catch!

BreizhHardware commented

2026-05-07 00:25:41 +02:00

Author

Owner

@binwiederhier commented on GitHub (Aug 18, 2023):

Hopefully fixed in https://github.com/binwiederhier/ntfy/pull/843

@binwiederhier commented on GitHub (Aug 18, 2023): Hopefully fixed in https://github.com/binwiederhier/ntfy/pull/843

BreizhHardware commented

2026-05-07 00:25:42 +02:00

Author

Owner

@Joe-0237 commented on GitHub (Aug 19, 2023):

E_* matches any E*
So I guess more generally sections of a patterns containing only _ and * are equivalent to *

I looked at the commit, I'm impressed with the testing, and scared of SQL xD but it does look like you got it, I'm glad we could help each other.

@Joe-0237 commented on GitHub (Aug 19, 2023): `E_*` matches any `E*` So I guess more generally sections of a patterns containing only `_` and `*` are equivalent to `*` I looked at the commit, I'm impressed with the testing, and scared of SQL xD but it does look like you got it, I'm glad we could help each other.

BreizhHardware commented

2026-05-07 00:25:42 +02:00

Author

Owner

@binwiederhier commented on GitHub (Aug 19, 2023):

As you saw it uses SQLite's wildcards, so there is not but I can do.

I looked at the commit, I'm impressed with the testing, and scared of SQL

Yeah, ... I was not happy with this complexity-add. I am not loving the wildcard-conversion thingy...

@binwiederhier commented on GitHub (Aug 19, 2023): As you saw it uses SQLite's wildcards, so there is not but I can do. > I looked at the commit, I'm impressed with the testing, and scared of SQL Yeah, ... I was not happy with this complexity-add. I am not loving the wildcard-conversion thingy...