[SSSD] [PATCH] RESPONDER: Ensure that all input strings are valid UTF-8

Simo Sorce simo at redhat.com
Tue Nov 15 14:14:20 UTC 2011


On Tue, 2011-11-15 at 14:01 +0100, Jakub Hrozek wrote:
> On Mon, Nov 14, 2011 at 11:59:36AM -0500, Simo Sorce wrote:
> > On Mon, 2011-11-14 at 11:35 -0500, Stephen Gallagher wrote:
> > > 
> > > Fixes https://fedorahosted.org/sssd/ticket/1088
> > 
> > Not sure this is the right thing to do.
> > 
> > Our LDAP backend insures we should get mostly utf8 stuff as that's what
> > supposedly is only allowed.
> > But we also have the proxy backend which means arbitrary nss plugins can
> > be plugged in.
> > 
> > Those could be sourcing data from old databases where code pages where
> > used instead of utf-8. Especially popular in Asiam conuntries where even
> > the first Unicode drafts were not good enough.
> > 
> > I would be more comfortable with a patch that makes dbus not validate
> > the input and an option (possibly enabled by default) for us to do utf-8
> > validation, but that can be set to not do any validation so that systems
> > that need user names in non-utf8 can have it (how we store non-utf8
> > names in sysdb is something we need to consider then).
> > 
> > Simo.
> > > 
> > -- 
> > Simo Sorce * Red Hat, Inc * New York
> > 
> 
> I agree that it's technically the correct way to do. However, I have
> only seen the proxy back end being used in production by accident by
> people who really intended to use pure LDAP provider.
> 
> Therefore, I would like to propose that we say that UTF-8 input would be
> treated as a known limitation of SSSD, file your suggestion as a Trac
> ticket which we would implement later.

Works for me.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list