[pve-devel] [PATCH container 1/1] fix #3748 changed regex-pattern to accept escape sequences on Comma

[pve-devel] [PATCH container 1/1] fix #3748 changed regex-pattern to accept escape sequences on Comma

[markus frank]

old-pattern: '\w+=[^,]+(,\s*\w+=[^,]+)*'
the old pattern didn't allow LDAP base domain name to be like: dc=first\, second, dc=com
new-pattern: qr(\w+=([^,\\]|\\,)+(,\s*\w+=([^,\\]|\\,)+)*),

---
 src/PVE/Auth/LDAP.pm | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/PVE/Auth/LDAP.pm b/src/PVE/Auth/LDAP.pm
index 97d0778..ad23cb2 100755
--- a/src/PVE/Auth/LDAP.pm
+++ b/src/PVE/Auth/LDAP.pm
@@ -19,7 +19,7 @@ sub properties {
 	base_dn => {
 	    description => "LDAP base domain name",
 	    type => 'string',
-	    pattern => '\w+=[^,]+(,\s*\w+=[^,]+)*',
+	    pattern => qr(\w+=([^,\\]|\\,)+(,\s*\w+=([^,\\]|\\,)+)*),
 	    optional => 1,
 	    maxLength => 256,
 	},
@@ -33,7 +33,7 @@ sub properties {
 	bind_dn => {
 	    description => "LDAP bind domain name",
 	    type => 'string',
-	    pattern => '\w+=[^,]+(,\s*\w+=[^,]+)*',
+	    pattern => qr(\w+=([^,\\]|\\,)+(,\s*\w+=([^,\\]|\\,)+)*),
 	    optional => 1,
 	    maxLength => 256,
 	},
@@ -91,7 +91,7 @@ sub properties {
 	    description => "LDAP base domain name for group sync. If not set, the"
 		." base_dn will be used.",
 	    type => 'string',
-	    pattern => '\w+=[^,]+(,\s*\w+=[^,]+)*',
+	    pattern => qr(\w+=([^,\\]|\\,)+(,\s*\w+=([^,\\]|\\,)+)*),
 	    optional => 1,
 	    maxLength => 256,
 	},
-- 
2.30.2

Re: [pve-devel] [PATCH container 1/1] fix #3748 changed regex-pattern to accept escape sequences on Comma

[Thomas Lamprecht]

On 19.01.22 13:21, Markus Frank wrote:
> Correction: Patch for access-control and not for container
> 

also missing your SOB (sign-off).

side note: our webmailer is currently a bit broken on reply, i.e., it omits the
In-Reply-to header which in turn breaks threading for all with a sensible MUA.
Thus I'd appreciate it greatly if you'd use another MTA/MUA that avoids such
issues for now, e.g., thunderbird or claws if you prefer graphical or (neo)mutt
or aerc if you prefer terminal based ones. On the long run keeping up with our
and other opensource's projects development lists via webmail alone may get
cumbersome fast anyway ;-)


>> On 19.01.2022 13:04 markus frank <m.frank@proxmox.com> wrote:
>>
>>  
>> old-pattern: '\w+=[^,]+(,\s*\w+=[^,]+)*'

I mean, I can see that from the commit diff, so not really adding much here

>> the old pattern didn't allow LDAP base domain name to be like: dc=first\, second, dc=com

that is good info though, maybe add that commas in LDAP paths require
escaping and so we explicitly allow for a escaped comma only.

>> new-pattern: qr(\w+=([^,\\]|\\,)+(,\s*\w+=([^,\\]|\\,)+)*),

abobe again a bit redundant with the diff.

>> ---
>>  src/PVE/Auth/LDAP.pm | 6 +++---
>>  1 file changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/src/PVE/Auth/LDAP.pm b/src/PVE/Auth/LDAP.pm
>> index 97d0778..ad23cb2 100755
>> --- a/src/PVE/Auth/LDAP.pm
>> +++ b/src/PVE/Auth/LDAP.pm
>> @@ -19,7 +19,7 @@ sub properties {
>>  	base_dn => {
>>  	    description => "LDAP base domain name",
>>  	    type => 'string',
>> -	    pattern => '\w+=[^,]+(,\s*\w+=[^,]+)*',
>> +	    pattern => qr(\w+=([^,\\]|\\,)+(,\s*\w+=([^,\\]|\\,)+)*),

nit: we do not really use () for quoted regex operator, I'd rather prefer one
of qr// qr!! or qr@@ which all have some use in our code base, IIRC.

Further, this disallows now some values including a \ that where ok previous,
is that intended or what's the idea here? The commit message does not talks about
it.

>>  	    optional => 1,
>>  	    maxLength => 256,
>>  	},
>> @@ -33,7 +33,7 @@ sub properties {
>>  	bind_dn => {
>>  	    description => "LDAP bind domain name",
>>  	    type => 'string',
>> -	    pattern => '\w+=[^,]+(,\s*\w+=[^,]+)*',
>> +	    pattern => qr(\w+=([^,\\]|\\,)+(,\s*\w+=([^,\\]|\\,)+)*),
>>  	    optional => 1,
>>  	    maxLength => 256,
>>  	},
>> @@ -91,7 +91,7 @@ sub properties {
>>  	    description => "LDAP base domain name for group sync. If not set, the"
>>  		." base_dn will be used.",
>>  	    type => 'string',
>> -	    pattern => '\w+=[^,]+(,\s*\w+=[^,]+)*',
>> +	    pattern => qr(\w+=([^,\\]|\\,)+(,\s*\w+=([^,\\]|\\,)+)*),
>>  	    optional => 1,
>>  	    maxLength => 256,
>>  	},
>> -- 
>> 2.30.2
>>