Handle (ignore) unknown options in get_domain() and get_service()

We will now eliminate any unknown options and providers to
guarantee that the domain is safe for use.

1 files changed, 28 insertions, 8 deletions

diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py
index 2978ef21f..8a7f609f3 100644
--- a/src/config/SSSDConfig.py
+++ b/src/config/SSSDConfig.py
@@ -943,7 +943,10 @@ class SSSDDomain(SSSDConfigObject):
         is_provider = option.rfind('_provider')
         if (is_provider > 0):
             provider = option[:is_provider]
-            self.add_provider(value, provider)
+            try:
+                self.add_provider(value, provider)
+            except NoSuchProviderError:
+                raise NoOptionError
         else:
             self.options[option] = value
 
@@ -1250,8 +1253,13 @@ class SSSDConfig(SSSDChangeConf):
             raise NoServiceError
 
         service = SSSDService(name, self.schema)
-        [service.set_option(opt['name'], opt['value'])
-         for opt in self.strip_comments_empty(self.options(name)) ]
+        for opt in self.strip_comments_empty(self.options(name)):
+            try:
+                service.set_option(opt['name'], opt['value'])
+            except NoOptionError:
+                # If we come across an option that we don't recognize,
+                # we should just ignore it and continue
+                pass
 
         return service
 
@@ -1447,12 +1455,24 @@ class SSSDConfig(SSSDChangeConf):
         # errors trying to read in their options
         providers = [ (x['name'],x['value']) for x in self.strip_comments_empty(self.options('domain/%s' % name))
                      if x['name'].rfind('_provider') > 0]
-        [domain.set_option(option, value)
-         for (option, value) in providers]
 
-        [domain.set_option(opt['name'], opt['value'])
-         for opt in self.strip_comments_empty(self.options('domain/%s' % name))
-         if (opt['name'], opt['value']) not in providers]
+        for (option, value) in providers:
+            try:
+                domain.set_option(option, value)
+            except NoOptionError:
+                # If we come across an option that we don't recognize,
+                # we should just ignore it and continue
+                pass
+
+        # Read in all the options from the configuration
+        for opt in self.strip_comments_empty(self.options('domain/%s' % name)):
+            if (opt['name'], opt['value']) not in providers:
+                try:
+                    domain.set_option(opt['name'], opt['value'])
+                except NoOptionError:
+                    # If we come across an option that we don't recognize,
+                    # we should just ignore it and continue
+                    pass
 
         # Determine if this domain is currently active
         domain.active = self.is_domain_active(name)