Bug 797565

Summary:	escaping commas is not working
Product:	Red Hat Enterprise Linux 6	Reporter:	Dmitri Pal <dpal>
Component:	ipa	Assignee:	Rob Crittenden <rcritten>
Status:	CLOSED ERRATA	QA Contact:	IDM QE LIST <seceng-idm-qe-list>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.3	CC:	jgalipea, mkosek, nsoman, sgoveas
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-2.2.0-6.el6	Doc Type:	Bug Fix
Doc Text:	Cause: Comma separated values (CSV) were splitted both in CLI part of IPA processing and the server part too. Consequence: Potential comma escaping was not recognized on the server because the escaping already got lost in client CSV processing. This lead to issues with values with comma included. Fix: CSV processing is done only in client interface. IPA server RPC interfaces (both XML-RPC and JSON-RPC) no longer process CSV values, it now expects either a scalar value or a list of scalar values. Comma escaping is replaced with quoting. Result: User can now pass quoted values with embedded commas to IPA CLI interface to avoid CSV split and thus properly pass the value with a comma to IPA server processing.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-06-20 13:19:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Dmitri Pal 2012-02-26 18:08:06 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/2417

There is a test in roles to verify that escaping commas works as expected. It is failing, as demonstrated by:

{{{
$ ipa role-add-privilege --privileges="u,r stuff" test
  Role name: test
  Description: test
  Failed members: 
    privilege: u: privilege not found
    privilege: r stuff: privilege not found
----------------------------
Number of privileges added 0
----------------------------
}}}

Comment 1 Martin Kosek 2012-03-22 16:50:16 UTC

Fixed upstream:

master: dddebe23507749486fb09d219f0da4f483ba4e79
ipa-2-2: 3738a611a678e6c23be38dacbad8955299cbe5bb

Note for testing:
The correct command is:

ipa role-add-privilege --privileges='"u,r stuff"' test

The double quotes are for the CSV parser. Single quotes are needed so the shell doesn't interpret the double ones.

Comment 4 Namita Soman 2012-04-12 13:02:06 UTC

Verified using ipa-server-2.2.0-8.el6.x86_64

# ipa role-add-privilege --privileges='"u, r stuff"' test
  Role name: test
  Description: test
  Privileges: u, r stuff
----------------------------
Number of privileges added 1
----------------------------

Also verified in UI.

Comment 5 Steeve Goveas 2012-04-13 09:06:50 UTC

1. Adding 2 comma separated privileges

[root@wheeljack ~]# ipa role-add-privilege --privileges="u,r stuff" test
  Role name: test
  Description: Test Role
  Privileges: u, r stuff
----------------------------
Number of privileges added 2
----------------------------

[root@wheeljack ~]# ipa role-remove-privilege --privileges="u,r stuff" test
  Role name: test
  Description: Test Role
------------------------------
Number of privileges removed 2
------------------------------


2. Adding a privilege having comma as part of the privilege name

[root@wheeljack ~]# ipa privilege-add 'u,r stuff'
Description: privilege with comma
---------------------------
Added privilege "u,r stuff"
---------------------------
  Privilege name: u,r stuff
  Description: privilege with comma

[root@wheeljack ~]# ipa role-add-privilege --privileges='"u,r stuff"' test
  Role name: test
  Description: Test Role
  Privileges: u,r stuff
----------------------------
Number of privileges added 1
----------------------------

Both above cases work as expected. Verified in version ipa-server-2.2.0-8.el6.x86_64

Comment 6 Martin Kosek 2012-04-24 12:55:02 UTC

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause: Comma separated values (CSV) were splitted both in CLI part of IPA processing and the server part too.
Consequence: Potential comma escaping was not recognized on the server because the escaping already got lost in client CSV processing. This lead to issues with values with comma included.
Fix: CSV processing is done only in client interface. IPA server RPC interfaces (both XML-RPC and JSON-RPC) no longer process CSV values, it now expects either a scalar value or a list of scalar values. Comma escaping is replaced with quoting.
Result: User can now pass quoted values with embedded commas to IPA CLI interface to avoid CSV split and thus properly pass the value with a comma to IPA server processing.

Comment 8 errata-xmlrpc 2012-06-20 13:19:39 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0819.html