summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEd Maste <emaste@FreeBSD.org>2017-08-19 00:32:26 +0000
committerEd Maste <emaste@FreeBSD.org>2017-08-19 00:32:26 +0000
commitaedba1a35eab0e795ce8bc54ad0be75390cb512b (patch)
tree148d5c2f0fc0e88423bd475ce4415515dd8b4a11
parentadfec1630313d82cd79f0d7a2ecefc14629fd610 (diff)
downloadpw-darwin-aedba1a35eab0e795ce8bc54ad0be75390cb512b.tar.gz
pw-darwin-aedba1a35eab0e795ce8bc54ad0be75390cb512b.tar.zst
pw-darwin-aedba1a35eab0e795ce8bc54ad0be75390cb512b.zip
pw useradd: Validate the user name before creating the entry
Previouly it was possible to create users with spaces in the name with: pw useradd -u 1234 -g 1234 -n 'test user' The "-g 1234" is relevant, without it the name was already rejected as expected: [fk@test ~]$ sudo pw useradd -u 1234 -n 'test user' pw: invalid character ` ' at position 4 in userid/group name Bug unintentionally found with a salt config without explicit name entry: test user: user.present: - uid: 1234 - gid: 1234 - fullname: Test user - shell: /usr/local/bin/bash - home: /home/test - groups: - wheel - salt "Luckily" salt modules rarely bother with input validation either ... PR: 221416 Submitted by: Fabian Keil Obtained from: ElectroBSD MFC after: 1 week
-rw-r--r--pw/pw_user.c4
-rwxr-xr-xpw/tests/pw_useradd_test.sh39
2 files changed, 41 insertions, 2 deletions
diff --git a/pw/pw_user.c b/pw/pw_user.c
index a71be12..92d5c6c 100644
--- a/pw/pw_user.c
+++ b/pw/pw_user.c
@@ -1202,7 +1202,7 @@ pw_user_add(int argc, char **argv, char *arg1)
if (arg1[strspn(arg1, "0123456789")] == '\0')
id = pw_checkid(arg1, UID_MAX);
else
- name = arg1;
+ name = pw_checkname(arg1, 0);
}
while ((ch = getopt(argc, argv, args)) != -1) {
@@ -1214,7 +1214,7 @@ pw_user_add(int argc, char **argv, char *arg1)
quiet = true;
break;
case 'n':
- name = optarg;
+ name = pw_checkname(optarg, 0);
break;
case 'u':
userid = optarg;
diff --git a/pw/tests/pw_useradd_test.sh b/pw/tests/pw_useradd_test.sh
index d14e4dd..1a1c7d3 100755
--- a/pw/tests/pw_useradd_test.sh
+++ b/pw/tests/pw_useradd_test.sh
@@ -176,6 +176,43 @@ user_add_name_too_long_body() {
${PW} useradd name_very_vert_very_very_very_long
}
+atf_test_case user_add_name_with_spaces
+user_add_name_with_spaces_body() {
+ populate_etc_skel
+ atf_check -s exit:65 -e match:"invalid character" \
+ ${PW} useradd 'test user'
+ atf_check -s exit:1 -o empty grep "^test user:.*" $HOME/master.passwd
+ # Try again with -n which uses a slightly different code path.
+ atf_check -s exit:65 -e match:"invalid character" \
+ ${PW} useradd -n 'test user'
+ atf_check -s exit:1 -o empty grep "^test user:.*" $HOME/master.passwd
+}
+
+atf_test_case user_add_name_with_spaces_and_gid_specified
+user_add_name_with_spaces_and_gid_specified_body() {
+ populate_etc_skel
+ gid=12345
+ user_name="test user"
+ # pw useradd should fail because of the space in the user
+ # name, not because the group doesn't exist.
+ atf_check -s exit:65 -e match:"invalid character" \
+ ${PW} useradd "${user_name}" -g ${gid}
+ atf_check -s exit:1 -o empty grep "^${user_name}:.*" $HOME/master.passwd
+ # Try again with -n which uses a slightly different code path.
+ atf_check -s exit:65 -e match:"invalid character" \
+ ${PW} useradd -n "${user_name}" -g ${gid}
+ atf_check -s exit:1 -o empty grep "^${user_name}:.*" $HOME/master.passwd
+ # Make sure the user isn't added even if the group exists
+ atf_check -s exit:0 ${PW} groupadd blafasel -g ${gid}
+ atf_check -s exit:65 -e match:"invalid character" \
+ ${PW} useradd "${user_name}" -g ${gid}
+ atf_check -s exit:1 -o empty grep "^${user_name}:.*" $HOME/master.passwd
+ # Try again with the -n option.
+ atf_check -s exit:65 -e match:"invalid character" \
+ ${PW} useradd -n "${user_name}" -g ${gid}
+ atf_check -s exit:1 -o empty grep "^${user_name}:.*" $HOME/master.passwd
+}
+
atf_test_case user_add_expiration
user_add_expiration_body() {
populate_etc_skel
@@ -415,6 +452,8 @@ atf_init_test_cases() {
atf_add_test_case user_add_password_expiration_date_month
atf_add_test_case user_add_password_expiration_date_relative
atf_add_test_case user_add_name_too_long
+ atf_add_test_case user_add_name_with_spaces
+ atf_add_test_case user_add_name_with_spaces_and_gid_specified
atf_add_test_case user_add_expiration
atf_add_test_case user_add_invalid_user_entry
atf_add_test_case user_add_invalid_group_entry