Bug 1108237 – [RFE] Enhance input validation for filters in access control

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1108237 - [RFE] Enhance input validation for filters in access control

Summary:	[RFE] Enhance input validation for filters in access control

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	ipa (Show other bugs)
Sub Component:
Version:	7.1
Hardware:	Unspecified Unspecified

Priority	medium Severity unspecified
Target Milestone:	rc
Target Release:	---
Assigned To:	Martin Kosek
QA Contact:	Namita Soman
Docs Contact:

URL:
Whiteboard:
Keywords:	FutureFeature

Depends On:	976382 1153292
Blocks:
	Show dependency tree / graph

Reported:	2014-06-11 10:59 EDT by Martin Kosek
Modified:	2015-03-05 05:12 EST (History)
CC List:	1 user (show)

See Also:
Fixed In Version:	ipa-4.0.3-1.el7
Doc Type:	Enhancement
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-03-05 05:12:24 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2015:0442	normal	SHIPPED_LIVE	Moderate: ipa security, bug fix, and enhancement update	2015-03-05 09:50:39 EST

Groups: None (edit)

Description Martin Kosek 2014-06-11 10:59:04 EDT

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/902

Delegation and permissions take LDAP filter as an argument. It is currently not validated. This ticket call for addition of the validation logic.

Comment 1 Martin Kosek 2014-06-11 11:23:33 EDT

This request is already fixed in upstream FreeIPA project. Please refer to the linked ticket for additional details and related commits.

Comment 3 Namita Soman 2015-01-26 17:49:25 EST

Verified using ipa-server-4.1.0-16.el7.x86_64

Using valid filter:
# ipa permission-add testperm1 --right=write --type=user --attrs=sn --filter="(cn=testgroup)"
----------------------------
Added permission "testperm1"
----------------------------
  Permission name: testperm1
  Granted rights: write
  Effective attributes: sn
  Bind rule type: permission
  Subtree: cn=users,cn=accounts,dc=testrelm,dc=test
  Extra target filter: (cn=testgroup)
  Type: user


Using invalid filter:
# ipa permission-add testperm2 --right=write --type=user --attrs=sn --filter="testgroup"
ipa: ERROR: invalid 'filter': must be enclosed in parentheses


# ipa permission-add testperm2 --right=write --type=user --attrs=sn --filter="(testgroup)"
ipa: ERROR: invalid 'ipapermtargetfilter': Bad search filter

Comment 5 errata-xmlrpc 2015-03-05 05:12:24 EST

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-0442.html

Note You need to log in before you can comment on or make changes to this bug.