From fbf3b41c541694348584024b5d6703b3ddfbde95 Mon Sep 17 00:00:00 2001
From: neil <gitsrc@neilpang.com>
Date: Sat, 4 Jul 2026 20:28:56 +0800
Subject: [PATCH] dns_inwx: fix _get_root false zone match for single-letter
 subdomains

_get_root matched the candidate zone with _contains (grep), which treats
the domain as a regex. For "-d g.<zone>" the candidate "g.<zone>" matched
"<string>...<zone>" because '.' matches the '>' after "string" and the 'g'
comes from the "<string>" tag, so "g.<zone>" was wrongly taken as the root
zone (sub=_acme-challenge instead of _acme-challenge.g). Anchor the match
to <string>$h</string> and escape dots so the zone is compared literally.

Fixes #5129
---
 dnsapi/dns_inwx.sh | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_inwx.sh b/dnsapi/dns_inwx.sh
index dba23846..460d4d28 100755
--- a/dnsapi/dns_inwx.sh
+++ b/dnsapi/dns_inwx.sh
@@ -307,13 +307,18 @@ _get_root() {
       return 1
     fi
 
-    if _contains "$response" "$h"; then
+    # Anchor the match to the XML tag and escape dots so $h is compared
+    # literally: _contains uses grep, which treats "$h" as a regex, and a
+    # bare "g.berlight.de" would match "<string>berlight.de" (the 'g' from
+    # "<string>" plus '.' matching '>'). See issue #5129.
+    _hregex=$(printf "%s" "$h" | sed 's/\./\\./g')
+    if _contains "$response" "<string>$_hregex</string>"; then
       _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-"$p")
       _domain="$h"
       return 0
     fi
     # IDN fallback: INWX returns Unicode zone names; when $h is ACE/punycode,
-    # encode each zone name via _idn() and compare — no python dependency.
+    # encode each zone name via _idn() and compare -- no python dependency.
     if _contains "$h" "xn--"; then
       _zone_unicode=$(printf "%s" "$response" | _egrep_o '<string>[^<]*' |
         sed 's/<[^>]*>//g' | while IFS= read -r _z; do