[SSSD] [PATCH] RESPONDER: Ensure that all input strings are valid UTF-8

Jakub Hrozek jhrozek at redhat.com
Tue Nov 15 13:01:15 UTC 2011


On Mon, Nov 14, 2011 at 11:59:36AM -0500, Simo Sorce wrote:
> On Mon, 2011-11-14 at 11:35 -0500, Stephen Gallagher wrote:
> > 
> > Fixes https://fedorahosted.org/sssd/ticket/1088
> 
> Not sure this is the right thing to do.
> 
> Our LDAP backend insures we should get mostly utf8 stuff as that's what
> supposedly is only allowed.
> But we also have the proxy backend which means arbitrary nss plugins can
> be plugged in.
> 
> Those could be sourcing data from old databases where code pages where
> used instead of utf-8. Especially popular in Asiam conuntries where even
> the first Unicode drafts were not good enough.
> 
> I would be more comfortable with a patch that makes dbus not validate
> the input and an option (possibly enabled by default) for us to do utf-8
> validation, but that can be set to not do any validation so that systems
> that need user names in non-utf8 can have it (how we store non-utf8
> names in sysdb is something we need to consider then).
> 
> Simo.
> > 
> -- 
> Simo Sorce * Red Hat, Inc * New York
> 

I agree that it's technically the correct way to do. However, I have
only seen the proxy back end being used in production by accident by
people who really intended to use pure LDAP provider.

Therefore, I would like to propose that we say that UTF-8 input would be
treated as a known limitation of SSSD, file your suggestion as a Trac
ticket which we would implement later.



More information about the sssd-devel mailing list