URL:
https://github.com/SSSD/sssd/pull/578
Title: #578: proxy: proxy_child hardening
mzidek-rh commented:
"""
@jhrozek Hi, sorry missed the question before (thanks @fidencio for the notice). AFAIK we
do not sanitize the domain name nor do we check if it is a valid domain name.
Slightly related: We have some sssctl config-check rules for the domain section name (but
I think they were problematic in some way, I think the rules are too benevolent and allow
also invalid domain names because we did not wanted to be too restricted in domain names,
but I would have to check the config-check code again if this was the case)
"""
See the full comment at
https://github.com/SSSD/sssd/pull/578#issuecomment-404465219