From 4447e04fa78e467b11f43373eb0c57d9889ac4c2 Mon Sep 17 00:00:00 2001
From: "Todd C. Miller" <Todd.Miller@courtesan.com>
Date: Wed, 12 Dec 2001 19:56:53 +0000
Subject: [PATCH] Don't let '#' appear in a {WORD} and restrict #foo in a Runas
 spec to #[0-9-]+.

---
 parse.lex | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/parse.lex b/parse.lex
index d712a3d56..3a39714e7 100644
--- a/parse.lex
+++ b/parse.lex
@@ -93,7 +93,7 @@ extern void yyerror		__P((char *));
 OCTET			(1?[0-9]{1,2})|(2[0-4][0-9])|(25[0-5])
 DOTTEDQUAD		{OCTET}(\.{OCTET}){3}
 HOSTNAME		[[:alnum:]_-]+
-WORD			([^@!=:,\(\) \t\n\\]|\\[^\n])+
+WORD			([^#@!=:,\(\) \t\n\\]|\\[^\n])+
 DEFVAR			[a-z_]+
 
 /* XXX - convert GOTRUNAS to exclusive state (GOTDEFS cannot be) */
@@ -251,7 +251,7 @@ PASSWD[[:blank:]]*:	{
 			    }
 			}
 
-<GOTRUNAS>#?{WORD}	{
+<GOTRUNAS>(#[0-9-]+|{WORD}) {
 			    /* username/uid that user can run command as */
 			    fill(yytext, yyleng);
 			    LEXTRACE("WORD(2) ");
-- 
2.40.0