Skip to content

escapes for injection protection - #7069

Merged
DaanHoogland merged 1 commit into
4.16from
ldapInjection
Jan 10, 2023
Merged

escapes for injection protection#7069
DaanHoogland merged 1 commit into
4.16from
ldapInjection

Conversation

@DaanHoogland

@DaanHoogland DaanHoogland commented Jan 9, 2023

Copy link
Copy Markdown
Contributor

Description

This PR fixes a theoretical issue n the ldap authentication plugin

Types of changes

  • Breaking change (fix or feature that would cause existing functionality to change)
  • New feature (non-breaking change which adds functionality)
  • Bug fix (non-breaking change which fixes an issue)
  • Enhancement (improves an existing feature and functionality)
  • Cleanup (Code refactoring and cleanup, that may add test cases)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

  • Major
  • Minor

Bug Severity

  • BLOCKER
  • Critical
  • Major
  • Minor
  • Trivial

Screenshots (if appropriate):

How Has This Been Tested?

tested in a lab env making sure the same imports could still be done.

before:

$ git fwd-merge 4.16
11:55:51
Merging release branch ***4.16*** into ***4.17*** branch in 5 seconds. CTRL+c to abort..
5 4 3 2 1 0 There we go!
Auto-merging plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/OpenLdapUserManagerImpl.java
Merge made by the 'ort' strategy.
 plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/OpenLdapUserManagerImpl.java | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
INFO: Actual diff in commits is: (running git log --pretty=oneline --abbrev-commit /4.17..4.17)

fatal: ambiguous argument '/4.17..4.17': unknown revision or path not in the working tree.
Use '--' to separate paths from revisions, like this:
'git <command> [<revision>...] -- [<file>...]'
We're done! Please double check using 'git log -p' and 'git push' when you're sure.

after:

$ git fwd-merge 4.17
11:57:55
Merging release branch ***4.17*** into ***main*** branch in 5 seconds. CTRL+c to abort..
5 4 3 2 1 0 There we go!
Merge made by the 'ort' strategy.
 plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/OpenLdapUserManagerImpl.java | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
INFO: Actual diff in commits is: (running git log --pretty=oneline --abbrev-commit d2bb6a2510e8b3f87dd1d32364744e3b36896bc1..main)

f3e05543cc (HEAD -> main) Merge release branch 4.17 to main
03674ce174 (apache/4.17, 4.17) Merge release branch 4.16 to 4.17
dffbc87278 (apache/4.16, 4.16) escapes for injection prtection (#7069)
We're done! Please double check using 'git log -p' and 'git push' when you're sure.

@DaanHoogland DaanHoogland added this to the 4.18.0.0 milestone Jan 9, 2023
@blueorangutan

Copy link
Copy Markdown

Packaging result: ✔️ el7 ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 5207

@DaanHoogland

Copy link
Copy Markdown
Contributor Author

@blueorangutan test matrix

@blueorangutan

Copy link
Copy Markdown

@DaanHoogland a Trillian-Jenkins matrix job (centos7 mgmt + xenserver71, rocky8 mgmt + vmware67u3, centos7 mgmt + kvmcentos7) has been kicked to run smoke tests

@blueorangutan

Copy link
Copy Markdown

Trillian test result (tid-5771)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 30391 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr7069-t5771-kvm-centos7.zip
Smoke tests completed. 92 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test Result Time (s) Test File

@blueorangutan

Copy link
Copy Markdown

Trillian test result (tid-5769)
Environment: xenserver-71 (x2), Advanced Networking with Mgmt server 7
Total time taken: 31918 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr7069-t5769-xenserver-71.zip
Smoke tests completed. 92 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test Result Time (s) Test File

@blueorangutan

Copy link
Copy Markdown

Trillian test result (tid-5770)
Environment: vmware-67u3 (x2), Advanced Networking with Mgmt server r8
Total time taken: 34235 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr7069-t5770-vmware-67u3.zip
Smoke tests completed. 91 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test Result Time (s) Test File
test_02_create_template_with_checksum_sha1 Error 5.15 test_templates.py
test_03_create_template_with_checksum_sha256 Error 5.16 test_templates.py
test_04_create_template_with_checksum_md5 Error 5.19 test_templates.py

@DaanHoogland
DaanHoogland marked this pull request as ready for review January 10, 2023 08:33

@weizhouapache weizhouapache left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

code lgtm

@DaanHoogland
DaanHoogland merged commit dffbc87 into 4.16 Jan 10, 2023
DaanHoogland added a commit that referenced this pull request Jan 10, 2023
* 4.16:
  escapes for injection prtection (#7069)
DaanHoogland added a commit that referenced this pull request Jan 10, 2023
* 4.17:
  escapes for injection prtection (#7069)
@DaanHoogland
DaanHoogland deleted the ldapInjection branch January 10, 2023 10:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants