[SSSD] [PATCH] Sanitize DN in sysdb_get_direct_parents

Jakub Hrozek jhrozek at redhat.com
Mon Oct 17 09:48:13 UTC 2011


It is potentially dangerous not to do so.
-------------- next part --------------
From 5c5dab03f665b9d3c655cb24f23e4fd85dc69562 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Sun, 16 Oct 2011 21:17:59 +0200
Subject: [PATCH] Sanitize DN in sysdb_get_direct_parents

---
 src/db/sysdb_search.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/src/db/sysdb_search.c b/src/db/sysdb_search.c
index b7f6a19..f5cd2cf 100644
--- a/src/db/sysdb_search.c
+++ b/src/db/sysdb_search.c
@@ -853,6 +853,7 @@ errno_t sysdb_get_direct_parents(TALLOC_CTX *mem_ctx,
 {
     errno_t ret;
     const char *dn;
+    char *sanitized_dn;
     struct ldb_dn *basedn;
     static const char *group_attrs[] = { SYSDB_NAME, NULL };
     const char *member_filter;
@@ -881,9 +882,14 @@ errno_t sysdb_get_direct_parents(TALLOC_CTX *mem_ctx,
         goto done;
     }
 
+    ret = sss_filter_sanitize(tmp_ctx, dn, &sanitized_dn);
+    if (ret != EOK) {
+        goto done;
+    }
+
     member_filter = talloc_asprintf(tmp_ctx, "(&(%s=%s)(%s=%s))",
                                     SYSDB_OBJECTCLASS, SYSDB_GROUP_CLASS,
-                                    SYSDB_MEMBER, dn);
+                                    SYSDB_MEMBER, sanitized_dn);
     if (!member_filter) {
         ret = ENOMEM;
         goto done;
-- 
1.7.6.4



More information about the sssd-devel mailing list