[SSSD] [PATCHSET] LDAP: sanitize group name when used in filter

Pavel Reichl preichl at redhat.com
Wed Aug 5 10:11:39 UTC 2015



On 08/05/2015 11:34 AM, Pavel Březina wrote:
> On 08/04/2015 03:52 PM, Pavel Reichl wrote:
>> Hello,
>>
>> please see 2 simple patches attached.
>>
>> I could not find function to sanitize DN so it could be used as part of
>> filter (sanitize ()*/\...) so I had to write one.
>>
>>   sysdb_dn_sanitize is not the right choice,
>>
>> sysdb_dn_sanitize("name=expired-group(2016),cn=groups,cn=LOCAL,cn=sysdb") 
>> ->
>> "name\\3Dexpired-group(2016)\\,cn\\3Dgroups\\,cn\\3DLOCAL\\,cn\\3Dsysdb"
>>
>> Thanks!
>
> Hi, I did just a quick read of your patches... can you take one more 
> step with creating a sanitized dn and create a more generic function 
> for that?
>
> Have you considered to modify sysdb_dn_sanitize to also escape 
> parentheses (that's what is misssing, isn't it)?
no because sysdb_dn_sanitize escapes also ',' and '=' and I need them to 
stat as they are

This is what I have: "name=expired-group(2016),cn=groups,cn=LOCAL,cn=sysdb"
This is what I need: 
"name=expired-group\282016\29,cn=groups,cn=LOCAL,cn=sysdb"  // just 
escape '(' and ')'
This is what sysdb_dn_sanitize returns: 
"name\\3Dexpired-group(2016)\\,cn\\3Dgroups\\,cn\\3DLOCAL\\,cn\\3Dsysdb"

Failing filter:
(&(objectClass=user)(|(memberOf=name=VDI-US02_Corporate-Environment(2013),cn=groups,cn=qut.edu.au,cn=sysdb)
Corrent filter
(&(objectClass=user)(|(memberOf=name=VDI-US02_Corporate-Environment\282013\29,cn=groups,cn=qut.edu.au,cn=sysdb)

I hope it's clearer now.
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list