- add a "disallowed chars" map attribute

- disallow ':' in attributes in passwd.byname and passwd.byuid
- disallow ':,' in attributes in group.byname and group.bygid

1 files changed, 57 insertions, 27 deletions

diff --git a/src/format.c b/src/format.c
index aabba07..2579eb2 100644
--- a/src/format.c
+++ b/src/format.c
@@ -49,7 +49,8 @@
 #define MAX_BUFFER_SIZE     0x100000
 static int format_expand(struct plugin_state *state,
 			 Slapi_PBlock *pb, Slapi_Entry *e,
-			 const char *domain, const char *map, const char *fmt,
+			 const char *domain, const char *map,
+			 const char *fmt, const char *disallowed,
 			 char *outbuf, int outbuf_len,
 			 char ***ref_attrs,
 			 struct format_inref_attr ***inref_attrs,
@@ -284,7 +285,8 @@ format_parse_args(struct plugin_state *state, const char *args,
 static int
 format_echo(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	    const char *domain, const char *map,
-	    const char *args, char *outbuf, int outbuf_len,
+	    const char *args, const char *disallowed,
+	    char *outbuf, int outbuf_len,
 	    char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	int ret, i, argc, len;
@@ -324,7 +326,8 @@ format_echo(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 static int
 format_list(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	    const char *domain, const char *map,
-	    const char *args, char *outbuf, int outbuf_len,
+	    const char *args, const char *disallowed,
+	    char *outbuf, int outbuf_len,
 	    char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	int ret, i, j, len, slen, count, argc;
@@ -403,7 +406,8 @@ format_list(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 static int
 format_deref(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	     const char *domain, const char *map,
-	     const char *args, char *outbuf, int outbuf_len,
+	     const char *args, const char *disallowed,
+	     char *outbuf, int outbuf_len,
 	     char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	int i, j, len, slen, ret, count, argc;
@@ -628,7 +632,8 @@ format_referred_entry_cb(Slapi_Entry *e, void *callback_data)
 static int
 format_referred(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	        const char *domain, const char *map,
-		const char *args, char *outbuf, int outbuf_len,
+		const char *args, const char *disallowed,
+		char *outbuf, int outbuf_len,
 	        char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	int i, j, len, slen, ret, count, argc;
@@ -756,7 +761,8 @@ format_referred(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 static int
 format_merge(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	     const char *domain, const char *map,
-	     const char *args, char *outbuf, int outbuf_len,
+	     const char *args, const char *disallowed,
+	     char *outbuf, int outbuf_len,
 	     char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	int ret, i, argc, len, slen, count;
@@ -778,7 +784,8 @@ format_merge(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		/* Expand this argument. */
 		slapi_log_error(SLAPI_LOG_PLUGIN, state->plugin_desc->spd_id,
 				"merge: expanding ->%s<-\n", argv[i]);
-		len = format_expand(state, pb, e, domain, map, argv[i],
+		len = format_expand(state, pb, e, domain, map,
+				    argv[i], disallowed,
 				    outbuf + ret + (count ? slen : 0),
 				    outbuf_len - (ret + (count ? slen : 0)),
 				    ref_attrs, inref_attrs, FALSE);
@@ -822,6 +829,7 @@ format_match_generic(struct plugin_state *state,
 		     Slapi_PBlock *pb, Slapi_Entry *e,
 		     const char *domain, const char *map,
 		     const char *args, int min_args, int default_arg,
+		     const char *disallowed,
 		     char *outbuf, int outbuf_len,
 		     char ***ref_attrs,
 		     struct format_inref_attr ***inref_attrs,
@@ -972,10 +980,12 @@ static int
 format_match(struct plugin_state *state,
 	     Slapi_PBlock *pb, Slapi_Entry *e,
 	     const char *domain, const char *map,
-	     const char *args, char *outbuf, int outbuf_len,
+	     const char *args, const char *disallowed,
+	     char *outbuf, int outbuf_len,
 	     char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	return format_match_generic(state, pb, e, domain, map, args, 2, 2,
+				    disallowed,
 				    outbuf, outbuf_len, ref_attrs, inref_attrs,
 				    "format_match", format_match_cb);
 }
@@ -999,10 +1009,12 @@ static int
 format_regmatch(struct plugin_state *state,
 	        Slapi_PBlock *pb, Slapi_Entry *e,
 		const char *domain, const char *map,
-	        const char *args, char *outbuf, int outbuf_len,
+	        const char *args, const char *disallowed,
+		char *outbuf, int outbuf_len,
 		char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	return format_match_generic(state, pb, e, domain, map, args, 2, 2,
+				    disallowed,
 				    outbuf, outbuf_len, ref_attrs, inref_attrs,
 				    "format_regmatch", format_regmatch_cb);
 }
@@ -1119,10 +1131,12 @@ static int
 format_regsub(struct plugin_state *state,
 	      Slapi_PBlock *pb, Slapi_Entry *e,
 	      const char *domain, const char *map,
-	      const char *args, char *outbuf, int outbuf_len,
+	      const char *args, const char *disallowed,
+	      char *outbuf, int outbuf_len,
 	      char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	return format_match_generic(state, pb, e, domain, map, args, 3, 3,
+				    disallowed,
 				    outbuf, outbuf_len, ref_attrs, inref_attrs,
 				    "format_regsub", format_regsub_cb);
 }
@@ -1137,7 +1151,7 @@ format_lookup_fn(const char *fnname)
 		int (*fct_ptr)(struct plugin_state *state,
 			       Slapi_PBlock *pb, Slapi_Entry *e,
 			       const char *domain, const char *map,
-			       const char *args,
+			       const char *args, const char *disallowed,
 			       char *outbuf, int outbuf_len,
 			       char ***ref_attrs,
 			       struct format_inref_attr ***inref_attrs);
@@ -1164,12 +1178,12 @@ format_lookup_fn(const char *fnname)
  * than one, fail. */
 static char *
 format_single(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
-	      const char *attr)
+	      const char *attr, const char *disallowed)
 {
 	Slapi_ValueSet *value_set;
 	Slapi_Value *value;
 	char *ret, *actual_attr;
-	const char *cret;
+	const char *cret, *d;
 	int count, disposition, buffer_flags;
 	if (slapi_vattr_values_get(e, (char *) attr, &value_set,
 				   &disposition, &actual_attr,
@@ -1182,7 +1196,17 @@ format_single(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		if (slapi_valueset_first_value(value_set, &value) == 0) {
 			cret = slapi_value_get_string(value);
 			if (cret != NULL) {
-				ret = strdup(cret);
+				if ((disallowed != NULL) &&
+				    ((d = strpbrk(cret, disallowed)) != NULL)) {
+					slapi_log_error(SLAPI_LOG_PLUGIN,
+							state->plugin_desc->spd_id,
+							"value for \"%s\" "
+							"contains disallowed "
+							"character %c\n",
+							attr, *d);
+				} else {
+					ret = strdup(cret);
+				}
 			}
 		}
 	} else {
@@ -1428,7 +1452,8 @@ static int
 format_expand_simple(struct plugin_state *state,
 		     Slapi_PBlock *pb, Slapi_Entry *e,
 		     const char *domain, const char *map,
-		     const char *fmt, char *outbuf, int outbuf_len,
+		     const char *fmt, const char *disallowed,
+		     char *outbuf, int outbuf_len,
 		     char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	char *shortstart, *longstart, *shortend, *longend;
@@ -1523,14 +1548,14 @@ format_expand_simple(struct plugin_state *state,
 		}
 	}
 	/* Retrieve the value. */
-	tmp = format_single(state, pb, e, attribute);
+	tmp = format_single(state, pb, e, attribute, disallowed);
 	if (tmp == NULL) {
 		/* The attribute is undefined, or we're treating it as if it
 		 * is. */
 		if (default_value != NULL) {
 			/* Supply the default value, expanding it if needed. */
 			i = format_expand(state, pb, e,
-					  domain, map, default_value,
+					  domain, map, default_value, NULL,
 					  outbuf, outbuf_len,
 					  ref_attrs, inref_attrs, FALSE);
 			free(expr);
@@ -1546,7 +1571,7 @@ format_expand_simple(struct plugin_state *state,
 		if (alternate_value != NULL) {
 			/* Supply the alternate value. */
 			i = format_expand(state, pb, e,
-					  domain, map, alternate_value,
+					  domain, map, alternate_value, NULL,
 					  outbuf, outbuf_len,
 					  ref_attrs, inref_attrs, FALSE);
 			free(tmp);
@@ -1584,7 +1609,8 @@ format_expand_simple(struct plugin_state *state,
  * evaluate it, otherwise return it. */
 static int
 format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
-	      const char *domain, const char *map, const char *fmt,
+	      const char *domain, const char *map,
+	      const char *fmt, const char *disallowed,
 	      char *outbuf, int outbuf_len,
 	      char ***ref_attrs, struct format_inref_attr ***inref_attrs,
 	      bool_t is_simple_expression)
@@ -1600,7 +1626,8 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	size_t spn;
 	int (*formatfn)(struct plugin_state *state,
 		        Slapi_PBlock *pb, Slapi_Entry *e,
-			const char *domain, const char *map, const char *args,
+			const char *domain, const char *map,
+			const char *args, const char *disallowed,
 		        char *outbuf, int outbuf_len,
 			char ***ref_attrs,
 			struct format_inref_attr ***inref_attrs);
@@ -1666,6 +1693,7 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 									domain,
 									map,
 									tmp,
+									disallowed,
 									expr + j,
 									exp_size - j,
 									ref_attrs,
@@ -1773,7 +1801,8 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 				}
 				/* Call the "function". */
 				exp_used = (*formatfn)(state, pb, e,
-						       domain, map, tmp,
+						       domain, map,
+						       tmp, disallowed,
 						       expr + j, exp_size - j,
 						       ref_attrs, inref_attrs);
 				free(tmp);
@@ -1818,7 +1847,8 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 
 	if (is_simple_expression) {
 		exp_used = format_expand_simple(state, pb, e, domain, map,
-						expr, outbuf, outbuf_len,
+						expr, disallowed,
+						outbuf, outbuf_len,
 						ref_attrs, inref_attrs);
 		if (exp_used < 0) {
 			free(expr);
@@ -1842,7 +1872,7 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 static char *
 format_format(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	      const char *domain, const char *map,
-	      const char *fmt,
+	      const char *fmt, const char *disallowed,
 	      char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	char *buf, *tmp, *ret, *spd_id;
@@ -1863,8 +1893,8 @@ format_format(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 			return NULL;
 		}
 
-		i = format_expand(state, pb, e, domain, map, fmt, buf, buflen,
-				  ref_attrs, inref_attrs, FALSE);
+		i = format_expand(state, pb, e, domain, map, fmt, disallowed,
+				  buf, buflen, ref_attrs, inref_attrs, FALSE);
 		if ((i >= 0) && (i < buflen)) {
 			buf[i] = '\0';
 			ret = strdup(buf);
@@ -1910,7 +1940,7 @@ format_format(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 char *
 format_get_data(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		const char *domain, const char *map,
-		const char *fmt,
+		const char *fmt, const char *disallowed,
 		char ***ref_attrs,
 		struct format_inref_attr ***inref_attrs)
 {
@@ -1925,7 +1955,7 @@ format_get_data(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		local_pb = NULL;
 	}
 
-	ret = format_format(state, pb, e, domain, map, fmt,
+	ret = format_format(state, pb, e, domain, map, fmt, disallowed,
 			    ref_attrs, inref_attrs);
 
 	/* If we supplied a PBlock, clean it up. */