Fix Complex filters #33
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If there were significant non-word characters at the end of a config
value, such as in a LDAP filter, the config parser silently dropped
them, because it used \b, which is defined as the boundary between \w
and \W.
This lead to ldap.FILTER_ERROR (Bad search filter) otherwise.
Instead of using \b, just capture everything up to the comment marker,
and strip the whitespace afterwards.
Input: pam_filter (&(|(c1=v1)(c1=v2))(c2=active))
Before: {'pam_filter': '(&(|(c1=v1)(c1=v2))(c2=active' }
Fixed: {'pam_filter': '(&(|(c1=v1)(c1=v2))(c2=active))' }
Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
RFC4515 requires filters to be wrapped with parenthesis '(' and ')'.
Over-wrapped filters are invalid! e.g. '((uid=x))'
OpenLDAP permits simple filters to omit parenthesis entirely:
e.g. 'uid=x' is automatically treated as '(uid=x)'
The OpenLDAP behavior is taken as a given in many uses, which can
lead to bad assumptions merging filters, because over-wrapped filters
ARE still rejected.
To cope with these cases, only wrap the incoming filter in
parenthesis if it does NOT already have them.
Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
robbat2
force-pushed
the
gentoo-fixes
branch
from
73ca780
to
8d71835
Compare
pyldap (now merged back into python-ldap-3), no longer supports end-of-life versions, notably Python 3.3. See: python-ldap/python-ldap@6e75fc4 Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
Tests for commit 130478a: - Lines with trailing comments - Lines ending in significant punctuation - Lines with trailing whitespace Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
robbat2
force-pushed
the
gentoo-fixes
branch
from
f4813a5
to
7de8b5c
Compare
|
Can you merge in the testcases in 7de8b5c as well? |
|
It is merged, I just squashed it with the previous one. |
|
Thanks; i missed that in a quick check |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Complex LDAP search filters used in
pam_filterbreak both the config parser & the filter builder. This PR fixes them :-).