mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-22 15:13:50 -06:00
404fe1018e
Do minimal validation of the Kerberos principal name when passing it to kinit command line tool. Also pass it as the final argument to prevent option injection. Accepted Kerberos principals are: - user names, using the following regexp (username with optional @realm, no spaces or slashes in the name): "(?!^[0-9]+$)^[a-zA-Z0-9_.][a-zA-Z0-9_.-]*[a-zA-Z0-9_.$-]?@?[a-zA-Z0-9.-]*$" - service names (with slash in the name but no spaces). Validation of the hostname is done. There is no validation of the service name. The regular expression above also covers cases where a principal name starts with '-'. This prevents option injection as well. This fixes CVE-2024-1481 Fixes: https://pagure.io/freeipa/issue/9541 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
68 lines
1.8 KiB
INI
68 lines
1.8 KiB
INI
[tox]
|
|
minversion=2.3.1
|
|
envlist=py36,py37,py38,pylint3,pypi
|
|
skip_missing_interpreters=true
|
|
skipsdist=true
|
|
|
|
[testenv]
|
|
allowlist_externals={toxinidir}/.tox-install.sh
|
|
# always re-create virtual env. A special install helper is used to configure,
|
|
# build and install packages.
|
|
recreate=True
|
|
sitepackages=True
|
|
install_command={toxinidir}/.tox-install.sh wheel_bundle {envpython} {envsitepackagesdir} {packages}
|
|
changedir={envdir}
|
|
setenv=
|
|
HOME={envtmpdir}
|
|
deps=
|
|
ipaclient
|
|
ipatests
|
|
commands=
|
|
{envbindir}/ipa --help
|
|
{envbindir}/ipa-run-tests --junitxml={envdir}/junit-{envname}.xml {posargs:--ipaclient-unittests} --ignore test_ipalib_install
|
|
|
|
[testenv:pylint3]
|
|
basepython=python3
|
|
deps=
|
|
ipaclient[otptoken_yubikey,ldap]
|
|
pylint
|
|
commands=
|
|
{envpython} -m pylint \
|
|
--rcfile={toxinidir}/pylintrc \
|
|
--load-plugins pylint_plugins \
|
|
{envsitepackagesdir}/ipaclient \
|
|
{envsitepackagesdir}/ipalib \
|
|
{envsitepackagesdir}/ipapython
|
|
|
|
[testenv:pypi]
|
|
recreate=True
|
|
install_command={toxinidir}/.tox-install.sh pypi_packages {envpython} {envsitepackagesdir} {packages}
|
|
changedir={envdir}
|
|
setenv=
|
|
HOME={envtmpdir}
|
|
deps=
|
|
pytest
|
|
ipaclient
|
|
# placeholder
|
|
ipaplatform
|
|
ipaserver
|
|
ipatests
|
|
commands=
|
|
{envpython} -m pytest {posargs:{toxinidir}/pypi/test_placeholder.py}
|
|
|
|
[pycodestyle]
|
|
# E402 module level import not at top of file
|
|
# E203 whitespace before ':' (not PEP-8)
|
|
# E231 missing whitespace after ',' (used by black)
|
|
# W503 line break before binary operator (not PEP-8)
|
|
# E731 do not assign a lambda expression
|
|
# E741 ambiguous variable name 'l'
|
|
ignore = E203, E402, E231, W503, E731, E741
|
|
max-line-length = 80
|
|
# exclude auto-generated remote plugins
|
|
exclude=.git,.venv,build,_build,rpmbuild,2_49,2_114,2_156,2_164
|
|
filename=*.py,*.in
|
|
|
|
[pytest]
|
|
addopts = -ra -v --ignore=prci_definitions/prci_checker.py
|