Skip to content

Conversation

@kevinAlbs
Copy link
Collaborator

Summary

Check SASL username length. See CDRIVER-6134 and linked tickets for more information.

Background

Cyrus-SASL 2.1.28 documents expected behavior of the callback:

int sasl_canon_user_t(sasl_conn_t *conn, void *context, const char *user, unsigned ulen,
                      unsigned flags, const char *user_realm, char *out_user,
                      unsigned out_umax, unsigned *out_ulen)

out_umax – Maximum length for out_user

Cyrus-SASL source suggests out_user is a buffer of size out_umax+1. However, since this does not appear clearly documented, this implementation assumes a size of out_umax.

Check in callback. Reject too-large username.
@kevinAlbs kevinAlbs requested a review from a team as a code owner October 22, 2025 18:54
Copy link
Contributor

@vector-of-bool vector-of-bool left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@kevinAlbs kevinAlbs merged commit b498496 into mongodb:master Oct 22, 2025
44 of 46 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants