From: Christopher Faulet <cfaulet@haproxy.com>
Date: Fri, 11 Sep 2026 08:09:40 +0000 (+0200)
Subject: BUG/MINOR: cli: Reject payload with no command
X-Git-Tag: v3.5-dev7~28
X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D$%7Bcid%7D?a=commitdiff_plain;h=45a8f06d4c00b84f96fa0e297dfa2d7342b6699a;p=haproxy.git

BUG/MINOR: cli: Reject payload with no command

No error is reported during command line parsing when a payload pattern is
found with no command. It is not really a big deal because when the command
is processed, because there is no command, nothing is executed. It is
harmless.

But, accordingly to the doc, the payload is the last argument of a
command. So a command is required. Thus, an error is now reported when a
payload is received with no command.

This patch could be backported to 3.4. Older versions could benefit of this
patch. If we decide to backport it farther, the patch will have to be
adapted.
---

diff --git a/src/cli.c b/src/cli.c
index 26f834224..ecca43d1a 100644
--- a/src/cli.c
+++ b/src/cli.c
@@ -1112,6 +1112,11 @@ int cli_parse_cmdline(struct appctx *appctx)
 				continue;
 			}
 
+			while (*str && (*str == ' ' || *str == '\t')) {
+				str++;
+				len--;
+			}
+
 			if (!len)
 				goto process_cmdline;
 
@@ -1146,6 +1151,11 @@ int cli_parse_cmdline(struct appctx *appctx)
 			if (strncmp(last_arg, PAYLOAD_PATTERN, strlen(PAYLOAD_PATTERN)) == 0) {
 				ssize_t pat_len = strlen(last_arg) - strlen(PAYLOAD_PATTERN);
 
+				if (str == last_arg) {
+					cli_err(appctx, "The payload cannot be passed without command.\n");
+					goto error;
+				}
+
 				/* A customized pattern can't be more than 64 characters
 				 * if it's more, don't make it a payload
 				 */