device_db entry keys ought to be sanitised #1696

New Issue

dpn · 2026-01-18T19:06:13+08:00

dpn commented

2026-01-18 19:06:13 +08:00

Migrated from GitHub: #2746

Currently, arbitrary strings are accepted as device_db keys (device names), including e.g. multi-line strings. This should be suitably restricted.

The ARTIQ design heavily suggests using Python identifiers as device names (setattr_device(), etc.), but this is not in fact enforced anywhere. This e.g. breaks log forwarding via the controller manager, where the device name is used as the log source, and line breaks and colons serve as special delimiters (but are not escaped).

It would probably be fine to require the devices names to be valid Python identifiers. Alternatively – to avoid unnecessarily breaking backwards compatibility in case somebody does use non-identifier device names – perhaps we could at least restrict them to be single-line and not contain :?

> **Migrated from GitHub:** [#2746](https://github.com/m-labs/artiq/issues/2746) --- Currently, arbitrary strings are accepted as device_db keys (device names), including e.g. multi-line strings. This should be suitably restricted. The ARTIQ design heavily suggests using Python identifiers as device names (`setattr_device()`, etc.), but this is not in fact enforced anywhere. This e.g. breaks log forwarding via the controller manager, where the device name is used as the log source, and line breaks and colons serve as special delimiters (but are not escaped). It would probably be fine to require the devices names to be valid Python identifiers. Alternatively – to avoid unnecessarily breaking backwards compatibility in case somebody does use non-identifier device names – perhaps we could at least restrict them to be single-line and not contain `:`?

sb10q closed this issue

2026-01-18 19:06:13 +08:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: M-Labs/artiq#1696