diff options
| author | Lukas Slebodnik <lslebodn@redhat.com> | 2015-09-01 06:58:50 +0200 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2015-09-23 15:50:01 +0200 |
| commit | 28dff998717b8bc70e28f39a8c7e3720c04305b7 (patch) | |
| tree | a58d1819a233a046aa73ce79564ea0536af68baf | |
| parent | f230eda50faaf95b5aaac7f4ec5ad6ab338930b1 (diff) | |
| download | sssd-28dff998717b8bc70e28f39a8c7e3720c04305b7.tar.gz sssd-28dff998717b8bc70e28f39a8c7e3720c04305b7.tar.xz sssd-28dff998717b8bc70e28f39a8c7e3720c04305b7.zip | |
LDAP: Sanitize group dn before using in filter
Each string should be sanitized(rfc4515) before using ldbsearch.
A group dn was not sanitized in the function cleanup_groups.
Resolves:
https://fedorahosted.org/sssd/ticket/2744
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
(cherry picked from commit 6cb5bad3c8e2f35ca9dce1800a506d626f90c079)
| -rw-r--r-- | src/providers/ldap/ldap_id_cleanup.c | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/src/providers/ldap/ldap_id_cleanup.c b/src/providers/ldap/ldap_id_cleanup.c index 171c9b0ae..73e5e6fc5 100644 --- a/src/providers/ldap/ldap_id_cleanup.c +++ b/src/providers/ldap/ldap_id_cleanup.c @@ -359,6 +359,8 @@ static int cleanup_groups(TALLOC_CTX *memctx, } for (i = 0; i < count; i++) { + char *sanitized_dn; + dn = ldb_dn_get_linearized(msgs[i]->dn); if (!dn) { DEBUG(SSSDBG_CRIT_FAILURE, "Cannot linearize DN!\n"); @@ -366,6 +368,15 @@ static int cleanup_groups(TALLOC_CTX *memctx, goto done; } + /* sanitize dn */ + ret = sss_filter_sanitize(tmpctx, dn, &sanitized_dn); + if (ret != EOK) { + DEBUG(SSSDBG_MINOR_FAILURE, + "sss_filter_sanitize failed: %s:[%d]\n", + sss_strerror(ret), ret); + goto done; + } + posix = ldb_msg_find_attr_as_string(msgs[i], SYSDB_POSIX, NULL); if (!posix || strcmp(posix, "TRUE") == 0) { /* Search for users that are members of this group, or @@ -375,11 +386,14 @@ static int cleanup_groups(TALLOC_CTX *memctx, gid = (gid_t) ldb_msg_find_attr_as_uint(msgs[i], SYSDB_GIDNUM, 0); subfilter = talloc_asprintf(tmpctx, "(&(%s=%s)(|(%s=%s)(%s=%lu)))", SYSDB_OBJECTCLASS, SYSDB_USER_CLASS, - SYSDB_MEMBEROF, dn, + SYSDB_MEMBEROF, sanitized_dn, SYSDB_GIDNUM, (long unsigned) gid); } else { - subfilter = talloc_asprintf(tmpctx, "(%s=%s)", SYSDB_MEMBEROF, dn); + subfilter = talloc_asprintf(tmpctx, "(%s=%s)", SYSDB_MEMBEROF, + sanitized_dn); } + talloc_zfree(sanitized_dn); + if (!subfilter) { DEBUG(SSSDBG_OP_FAILURE, "Failed to build filter\n"); ret = ENOMEM; |