[SSSD] [PATCH] RESPONDER: Ensure that all input strings are valid UTF-8

Jakub Hrozek jhrozek at redhat.com
Tue Nov 15 14:33:37 UTC 2011


On Tue, Nov 15, 2011 at 09:14:20AM -0500, Simo Sorce wrote:
> On Tue, 2011-11-15 at 14:01 +0100, Jakub Hrozek wrote:
> > On Mon, Nov 14, 2011 at 11:59:36AM -0500, Simo Sorce wrote:
> > > On Mon, 2011-11-14 at 11:35 -0500, Stephen Gallagher wrote:
> > > > 
> > > > Fixes https://fedorahosted.org/sssd/ticket/1088
> > > 
> > > Not sure this is the right thing to do.
> > > 
> > > Our LDAP backend insures we should get mostly utf8 stuff as that's what
> > > supposedly is only allowed.
> > > But we also have the proxy backend which means arbitrary nss plugins can
> > > be plugged in.
> > > 
> > > Those could be sourcing data from old databases where code pages where
> > > used instead of utf-8. Especially popular in Asiam conuntries where even
> > > the first Unicode drafts were not good enough.
> > > 
> > > I would be more comfortable with a patch that makes dbus not validate
> > > the input and an option (possibly enabled by default) for us to do utf-8
> > > validation, but that can be set to not do any validation so that systems
> > > that need user names in non-utf8 can have it (how we store non-utf8
> > > names in sysdb is something we need to consider then).
> > > 
> > > Simo.
> > > > 
> > > -- 
> > > Simo Sorce * Red Hat, Inc * New York
> > > 
> > 
> > I agree that it's technically the correct way to do. However, I have
> > only seen the proxy back end being used in production by accident by
> > people who really intended to use pure LDAP provider.
> > 
> > Therefore, I would like to propose that we say that UTF-8 input would be
> > treated as a known limitation of SSSD, file your suggestion as a Trac
> > ticket which we would implement later.
> 
> Works for me.
> 
> Simo.
> 

Thank you, I filed https://fedorahosted.org/sssd/ticket/1091 so that the
enhancement is tracked and does not get forgotten.



More information about the sssd-devel mailing list