>From 6500b1a96319f87c5f1469069dcbe6eecd9c4a29 Mon Sep 17 00:00:00 2001 From: Lukas Slebodnik Date: Tue, 1 Sep 2015 06:58:50 +0200 Subject: [PATCH 1/2] LDAP: Sanitize group dn before using in filter MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Each string should be sanitized(rfc4515) before using ldbsearch. A group dn was not sanitized in the function cleanup_groups. Resolves: https://fedorahosted.org/sssd/ticket/2744 Reviewed-by: Pavel Březina (cherry picked from commit 6cb5bad3c8e2f35ca9dce1800a506d626f90c079) --- src/providers/ldap/ldap_id_cleanup.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/src/providers/ldap/ldap_id_cleanup.c b/src/providers/ldap/ldap_id_cleanup.c index 171c9b0aecd35f3ddabb00e5c260b66981a1d0f4..73e5e6fc509ba09b827cbd88eff3e1a6454918a0 100644 --- a/src/providers/ldap/ldap_id_cleanup.c +++ b/src/providers/ldap/ldap_id_cleanup.c @@ -359,6 +359,8 @@ static int cleanup_groups(TALLOC_CTX *memctx, } for (i = 0; i < count; i++) { + char *sanitized_dn; + dn = ldb_dn_get_linearized(msgs[i]->dn); if (!dn) { DEBUG(SSSDBG_CRIT_FAILURE, "Cannot linearize DN!\n"); @@ -366,6 +368,15 @@ static int cleanup_groups(TALLOC_CTX *memctx, goto done; } + /* sanitize dn */ + ret = sss_filter_sanitize(tmpctx, dn, &sanitized_dn); + if (ret != EOK) { + DEBUG(SSSDBG_MINOR_FAILURE, + "sss_filter_sanitize failed: %s:[%d]\n", + sss_strerror(ret), ret); + goto done; + } + posix = ldb_msg_find_attr_as_string(msgs[i], SYSDB_POSIX, NULL); if (!posix || strcmp(posix, "TRUE") == 0) { /* Search for users that are members of this group, or @@ -375,11 +386,14 @@ static int cleanup_groups(TALLOC_CTX *memctx, gid = (gid_t) ldb_msg_find_attr_as_uint(msgs[i], SYSDB_GIDNUM, 0); subfilter = talloc_asprintf(tmpctx, "(&(%s=%s)(|(%s=%s)(%s=%lu)))", SYSDB_OBJECTCLASS, SYSDB_USER_CLASS, - SYSDB_MEMBEROF, dn, + SYSDB_MEMBEROF, sanitized_dn, SYSDB_GIDNUM, (long unsigned) gid); } else { - subfilter = talloc_asprintf(tmpctx, "(%s=%s)", SYSDB_MEMBEROF, dn); + subfilter = talloc_asprintf(tmpctx, "(%s=%s)", SYSDB_MEMBEROF, + sanitized_dn); } + talloc_zfree(sanitized_dn); + if (!subfilter) { DEBUG(SSSDBG_OP_FAILURE, "Failed to build filter\n"); ret = ENOMEM; -- 2.5.0