diff options
| author | Gary Lockyer <gary@catalyst.net.nz> | 2018-08-03 15:51:28 +1200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2018-08-11 21:56:41 +0200 |
| commit | ddd6279e122405e87770db173234a26c5d81a616 (patch) | |
| tree | 1ce70d26c73d1f428b662d14759eaf7cd8ea70c7 | |
| parent | 1594cade555d96461b5b9db9965d8cdf9f5e45e0 (diff) | |
| download | samba-ddd6279e122405e87770db173234a26c5d81a616.tar.gz | |
CVE-2018-10919 tests: test ldap searches for non-existent attributes.
It is perfectly legal to search LDAP for an attribute that is not part
of the schema. That part of the query should simply not match.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
| -rwxr-xr-x | source4/dsdb/tests/python/ldap.py | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/source4/dsdb/tests/python/ldap.py b/source4/dsdb/tests/python/ldap.py index 4235541fdbe..2514d0a9d72 100755 --- a/source4/dsdb/tests/python/ldap.py +++ b/source4/dsdb/tests/python/ldap.py @@ -599,6 +599,15 @@ class BasicTests(samba.tests.TestCase): except LdbError, (num, _): self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE) + # + # When searching the unknown attribute should be ignored + expr = "(|(cn=ldaptestgroup)(thisdoesnotexist=x))" + res = ldb.search(base=self.base_dn, + expression=expr, + scope=SCOPE_SUBTREE) + self.assertTrue(len(res) == 1, + "Search including unknown attribute failed") + delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn) # attributes not in objectclasses and mandatory attributes missing test |