Pete Zaitcev wrote:
commit 74c902ecc2b518ce666c3649ec8c730a9a0c301b
Author: Pete Zaitcev <zaitcev(a)yahoo.com>
Date: Wed Jun 8 20:36:03 2011 -0600
Escape the generated JSON
I forgot to escape JSON that is generated to be an argument for back-end.
But the password string can contain just about anything, for example.
This was found by using Windows username in form of DOMAIN\USER, when
it caused an "invalid escape" condition in JSON parser.
Thanks.
ACK with minor suggestions
I thought this was already in the code, since I first saw
the patch a week or two ago.
NEWS | 4 +++
backend.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++----------
2 files changed, 77 insertions(+), 15 deletions(-)
---
diff --git a/NEWS b/NEWS
index 110500b..80bdc69 100644
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,10 @@ iwhd NEWS -*-
outline -*-
mongod failed to start in time. Now, when mongod fails to start, that
"start" function also fails.
+ It is now possible to use Windows.Domain\Administrator as a user name
+ in a cloud with Windows credentials. The back slash was causing an
A typo worth fixing, esp. since one might search for the keyword:
s/back slash/backslash/
+ internal error due to improper JSON escaping.
+
* Noteworthy changes in release 0.95 (2011-05-17) [stable]
diff --git a/backend.c b/backend.c
index 251d730..fb1c525 100644
--- a/backend.c
+++ b/backend.c
@@ -1344,6 +1344,76 @@ fs_bcreate (const provider_t *prov, const char *bucket)
return MHD_HTTP_OK;
}
+static char *json_escape(const char *str)
+{
+ char *escaped_str, *p;
+ int cnt;
+ int i;
Please make these two variables unsigned, to match their semantics.
Then the reader doesn't have to wonder if they make sense when negative.
+ cnt = 0;
+ for (i = 0; str[i]; i++) {
+ if (str[i] == '\\' || str[i] == '"')
+ cnt++;
+ cnt++;
+ }
+ escaped_str = malloc(cnt+1);
+ if (!escaped_str)
+ return NULL;
+ p = escaped_str;
+ for (i = 0; str[i]; i++) {
+ if (str[i] == '\\' || str[i] == '"')
+ *p++ = '\\';
+ *p++ = str[i];
+ }
+ *p++ = '\0';
+ return escaped_str;
+}
+
+static char *
+fs_rhevm_genconf(const char *bucket, const char *key, const char *api_url,
+ const char *api_user, const char *api_secret,
+ const char *nfs_host, const char *nfs_path, const char *nfs_dir)
+{
+ int rc;
+ char *b, *k, *url, *user, *pass, *nhost, *npath, *ndir;
+ char *ret = NULL;
+
+ b = json_escape(bucket);
+ k = json_escape(key);
+ url = json_escape(api_url);
+ user = json_escape(api_user);
+ pass = json_escape(api_secret);
+ nhost = json_escape(nfs_host);
+ npath = json_escape(nfs_path);
+ ndir = json_escape(nfs_dir);
+ if (!b || !k || !url || !user || !pass || !nhost || !npath || !ndir)
+ goto err;
You can save two lines and make the code slightly more
readable/maintainable like this, but it's style,
(in your code), so you're welcome to ignore the suggestion:
char *ret = NULL;
char *b = json_escape(bucket);
char *k = json_escape(key);
char *url = json_escape(api_url);
char *user = json_escape(api_user);
char *pass = json_escape(api_secret);
char *nhost = json_escape(nfs_host);
char *npath = json_escape(nfs_path);
char *ndir = json_escape(nfs_dir);
int rc = asprintf(&ret,
+ rc = asprintf(&ret,
+ "{\n"
+ " \"image\" : \"%s/%s\",\n"
+ " \"apiurl\" : \"%s\",\n"
+ " \"apiuser\" : \"%s\",\n"
+ " \"apipass\" : \"%s\",\n"
+ " \"nfshost\" : \"%s\",\n"
+ " \"nfspath\" : \"%s\",\n"
+ " \"nfsdir\" : \"%s\"\n"
+ "}\n",
+ b, k, url, user, pass, nhost, npath, ndir);
+ if (rc < 0)
+ ret = NULL; /* for undefined behaviour in asprintf() */
+ err:
+ free(ndir);
+ free(npath);
+ free(nhost);
+ free(pass);
+ free(user);
+ free(url);
+ free(k);
+ free(b);
+ return ret;
+}
+
static int
fs_rhevm_register (my_state *ms, const provider_t *prov, const char *next,
Hash_table *args)
@@ -1367,7 +1437,6 @@ fs_rhevm_register (my_state *ms, const provider_t *prov, const char
*next,
char *s;
char ami_id_buf[64];
regmatch_t match[2];
- int rc;
strcpy(ami_id_buf, "none");
@@ -1449,21 +1518,10 @@ fs_rhevm_register (my_state *ms, const provider_t *prov, const
char *next,
ret = MHD_HTTP_INTERNAL_SERVER_ERROR;
- rc = asprintf(&conf_text,
- "{\n"
- " \"image\" : \"%s/%s\",\n"
- " \"apiurl\" : \"%s\",\n"
- " \"apiuser\" : \"%s\",\n"
- " \"apipass\" : \"%s\",\n"
- " \"nfshost\" : \"%s\",\n"
- " \"nfspath\" : \"%s\",\n"
- " \"nfsdir\" : \"%s\"\n"
- "}\n",
- ms->bucket, ms->key,
+ conf_text = fs_rhevm_genconf(ms->bucket, ms->key,
api_url, api_user, api_secret,
- nfs_host, nfs_path, nfs_dir
- );
- if (rc < 0) {
+ nfs_host, nfs_path, nfs_dir);
+ if (!conf_text) {
error (0, 0, _("no core"));
goto cleanup;
}