[SSSD] [PATCH] Sanitize DN in sysdb_get_direct_parents
Jakub Hrozek
jhrozek at redhat.com
Mon Oct 17 09:48:13 UTC 2011
It is potentially dangerous not to do so.
-------------- next part --------------
From 5c5dab03f665b9d3c655cb24f23e4fd85dc69562 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Sun, 16 Oct 2011 21:17:59 +0200
Subject: [PATCH] Sanitize DN in sysdb_get_direct_parents
---
src/db/sysdb_search.c | 8 +++++++-
1 files changed, 7 insertions(+), 1 deletions(-)
diff --git a/src/db/sysdb_search.c b/src/db/sysdb_search.c
index b7f6a19..f5cd2cf 100644
--- a/src/db/sysdb_search.c
+++ b/src/db/sysdb_search.c
@@ -853,6 +853,7 @@ errno_t sysdb_get_direct_parents(TALLOC_CTX *mem_ctx,
{
errno_t ret;
const char *dn;
+ char *sanitized_dn;
struct ldb_dn *basedn;
static const char *group_attrs[] = { SYSDB_NAME, NULL };
const char *member_filter;
@@ -881,9 +882,14 @@ errno_t sysdb_get_direct_parents(TALLOC_CTX *mem_ctx,
goto done;
}
+ ret = sss_filter_sanitize(tmp_ctx, dn, &sanitized_dn);
+ if (ret != EOK) {
+ goto done;
+ }
+
member_filter = talloc_asprintf(tmp_ctx, "(&(%s=%s)(%s=%s))",
SYSDB_OBJECTCLASS, SYSDB_GROUP_CLASS,
- SYSDB_MEMBER, dn);
+ SYSDB_MEMBER, sanitized_dn);
if (!member_filter) {
ret = ENOMEM;
goto done;
--
1.7.6.4
More information about the sssd-devel
mailing list