Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

escape DN attribute values #4117

Merged
merged 2 commits into from
Jul 7, 2022
Merged

escape DN attribute values #4117

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2707c2f
escape DN attribute values
Jul 6, 2022
00a27bf
fix the null byte replace
Jul 6, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions changelog/unreleased/ldap-escape-dn.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
Bugfix: Escape DN attribute value

Escaped the DN attribute value on creating users and groups.


https://github.com/owncloud/ocis/pull/4117
32 changes: 32 additions & 0 deletions ocis-pkg/ldap/ldap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import (
"errors"
"io/ioutil"
"os"
"strings"
"time"

"github.com/owncloud/ocis/v2/ocis-pkg/log"
Expand All @@ -15,6 +16,20 @@ const (
caCheckSleep = 2
)

var (
dnEscaper = strings.NewReplacer(
"\\", "\\\\",
",", "\\,",
"+", "\\+",
`"`, `\\"`,
"<", "\\<",
">", "\\>",
";", "\\;",
"=", "\\=",
"\000", "\\\000",
Copy link
Contributor

@rhafer rhafer Jul 6, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If I am reading rfc4514 correctly the null byte as to be escaped as \00 which would be:

Suggested change
"\000", "\\\000",
"\000", "\\00",

Only ' ', '"', '#', '+', ',', ';', '<', '=', '>', or '\' can be escape by prepending a backslash

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a tricky one but I argue that this is correct.

The left side is the "search" pattern so we are looking for the null byte which as a string is represented like \000 (octal) or \x00 (hex) both forms result in the null byte.

Now the right (replace) part is actually to things. First \\ and second \000 Together it results in \00 but in string form it needs to be typed as it is above.

https://go.dev/play/p/IzDMsTunmaj

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am still not fully convinced 🙂 what I am referring to is this sentence of the RFC:

Each octet of the character to be escaped is replaced by a backslash
and two hex digits, which form a single octet in the code of the
character.  Alternatively, if and only if the character to be escaped
is one of

      ' ', '"', '#', '+', ',', ';', '<', '=', '>', or '\'

it can be prefixed by a backslash ('\' U+005C).

So the null Byte (\000 in go) needs to be translated into the string \00 (backslash + two hex digits representing the single octet of the "null character"). As the backslash needs to be escaped in go we get \\00. (At least if I am not missing anything obvious)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, after researching a bit I found that you are right.
This also means that the python library I took inspiration from must be wrong 😅 : https://github.com/python-ldap/python-ldap/blob/44a593d1c55a007a43fcf30d2b027ac910ea1b96/Lib/ldap/dn.py#L31

Copy link
Contributor Author

@C0rby C0rby Jul 6, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a tricky one but I argue that this is correct.

The left side is the "search" pattern so we are looking for the null byte which as a string is represented like \000 (octal) or \x00 (hex) both forms result in the null byte.

Now the right (replace) part is actually to things. First \\ and second \000 Together it results in \00 but in string form it needs to be typed as it is above.

https://go.dev/play/p/

I see now why this doesn't make sense. :D

)
)

func WaitForCA(log log.Logger, insecure bool, caCert string) error {
if !insecure && caCert != "" {
for i := 0; i < caCheckRetries; i++ {
Expand All @@ -38,3 +53,20 @@ func WaitForCA(log log.Logger, insecure bool, caCert string) error {
}
return nil
}

// EscapeDNAttributeValue escapes special characters in an attribute value as [described in RFC4514](https://datatracker.ietf.org/doc/html/rfc4514).
func EscapeDNAttributeValue(v string) string {
if v == "" {
return v
}

v = dnEscaper.Replace(v)

if strings.HasSuffix(v, " ") {
v = v[:len(v)-1] + "\\ "
}
if strings.HasPrefix(v, "#") || strings.HasPrefix(v, " ") {
v = "\\" + v
}
return v
}
13 changes: 13 additions & 0 deletions ocis-pkg/ldap/ldap_suite_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
package ldap_test

import (
"testing"

. "github.com/onsi/ginkgo/v2"
. "github.com/onsi/gomega"
)

func TestLdap(t *testing.T) {
RegisterFailHandler(Fail)
RunSpecs(t, "Ldap Suite")
}
25 changes: 25 additions & 0 deletions ocis-pkg/ldap/ldap_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
package ldap_test

import (
. "github.com/onsi/ginkgo/v2"
. "github.com/onsi/gomega"
"github.com/owncloud/ocis/v2/ocis-pkg/ldap"
)

var _ = Describe("ldap", func() {
DescribeTable("EscapeDNAttributeValue should escape special characters",
func(input, expected string) {
escaped := ldap.EscapeDNAttributeValue(input)
Expect(escaped).To(Equal(expected))
},
Entry("normal dn", "foobar", "foobar"),
Entry("including comma", "foo,bar", "foo\\,bar"),
Entry("including equals", "foo=bar", "foo\\=bar"),
Entry("beginning with number sign", "#foobar", "\\#foobar"),
Entry("beginning with space", " foobar", "\\ foobar"),
Entry("only one space", " ", "\\ "),
Entry("two spaces", " ", "\\ \\ "),
Entry("ending with space", "foobar ", "foobar\\ "),
Entry("containing multiple special chars", `f+o>o,b<a;r="\00"`, `f\+o\>o\,b\<a\;r\=\\"\\00\\"`),
)
})
5 changes: 3 additions & 2 deletions services/graph/pkg/identity/ldap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ import (
"github.com/gofrs/uuid"
ldapdn "github.com/libregraph/idm/pkg/ldapdn"
libregraph "github.com/owncloud/libre-graph-api-go"
oldap "github.com/owncloud/ocis/v2/ocis-pkg/ldap"
"github.com/owncloud/ocis/v2/ocis-pkg/log"
"github.com/owncloud/ocis/v2/services/graph/pkg/config"
"github.com/owncloud/ocis/v2/services/graph/pkg/service/v0/errorcode"
Expand Down Expand Up @@ -116,7 +117,7 @@ func (i *LDAP) CreateUser(ctx context.Context, user libregraph.User) (*libregrap
return nil, errReadOnly
}
ar := ldap.AddRequest{
DN: fmt.Sprintf("uid=%s,%s", *user.OnPremisesSamAccountName, i.userBaseDN),
DN: fmt.Sprintf("uid=%s,%s", oldap.EscapeDNAttributeValue(*user.OnPremisesSamAccountName), i.userBaseDN),
Attributes: []ldap.Attribute{
// inetOrgPerson requires "cn"
{
Expand Down Expand Up @@ -691,7 +692,7 @@ func (i *LDAP) CreateGroup(ctx context.Context, group libregraph.Group) (*libreg
return nil, errorcode.New(errorcode.NotAllowed, "server is configured read-only")
}
ar := ldap.AddRequest{
DN: fmt.Sprintf("cn=%s,%s", *group.DisplayName, i.groupBaseDN),
DN: fmt.Sprintf("cn=%s,%s", oldap.EscapeDNAttributeValue(*group.DisplayName), i.groupBaseDN),
Attributes: []ldap.Attribute{
{
Type: i.groupAttributeMap.name,
Expand Down