From ace43c8ce02d19cf536ce35749aa2ed734089189 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Thu, 18 Aug 2022 13:55:21 +0200 Subject: [PATCH 20/23] oidc_child: escape scopes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Before using the user provided scopes in the HTTP request they should be properly escaped according to RFC-3986. Resolves: https://github.com/SSSD/sssd/issues/6146 Reviewed-by: Justin Stephenson Reviewed-by: Pavel Březina (cherry picked from commit 12d5c6344ee304c1f3bc155a76ab37fcd20e78cb) Reviewed-by: Alexey Tikhonov --- src/oidc_child/oidc_child.c | 4 ++-- src/oidc_child/oidc_child_curl.c | 35 ++++++++++++++++++++++++++++++++ src/oidc_child/oidc_child_util.h | 2 ++ 3 files changed, 39 insertions(+), 2 deletions(-) diff --git a/src/oidc_child/oidc_child.c b/src/oidc_child/oidc_child.c index e58afccd3..aeeac3595 100644 --- a/src/oidc_child/oidc_child.c +++ b/src/oidc_child/oidc_child.c @@ -119,9 +119,9 @@ static errno_t set_endpoints(struct devicecode_ctx *dc_ctx, } if (scope != NULL && *scope != '\0') { - dc_ctx->scope = talloc_strdup(dc_ctx, scope); + dc_ctx->scope = url_encode_string(dc_ctx, scope); if (dc_ctx->scope == NULL) { - DEBUG(SSSDBG_CRIT_FAILURE, "Failed to copy scopes.\n"); + DEBUG(SSSDBG_CRIT_FAILURE, "Failed to encode and copy scopes.\n"); ret = ENOMEM; goto done; } diff --git a/src/oidc_child/oidc_child_curl.c b/src/oidc_child/oidc_child_curl.c index 20e17a566..df438e007 100644 --- a/src/oidc_child/oidc_child_curl.c +++ b/src/oidc_child/oidc_child_curl.c @@ -26,6 +26,41 @@ #include #include "oidc_child/oidc_child_util.h" +char *url_encode_string(TALLOC_CTX *mem_ctx, const char *inp) +{ + CURL *curl_ctx = NULL; + char *tmp; + char *out = NULL; + + if (inp == NULL) { + DEBUG(SSSDBG_TRACE_ALL, "Empty input.\n"); + return NULL; + } + + curl_ctx = curl_easy_init(); + if (curl_ctx == NULL) { + DEBUG(SSSDBG_OP_FAILURE, "Failed to initialize curl.\n"); + return NULL; + } + + tmp = curl_easy_escape(curl_ctx, inp, 0); + if (tmp == NULL) { + DEBUG(SSSDBG_TRACE_ALL, "curl_easy_escape failed for [%s].\n", inp); + goto done; + } + + out = talloc_strdup(mem_ctx, tmp); + curl_free(tmp); + if (out == NULL) { + DEBUG(SSSDBG_TRACE_ALL, "talloc_strdup failed.\n"); + goto done; + } + +done: + curl_easy_cleanup(curl_ctx); + return (out); +} + /* The curl write_callback will always append the received data. To start a * new string call clean_http_data() before the curl request.*/ void clean_http_data(struct devicecode_ctx *dc_ctx) diff --git a/src/oidc_child/oidc_child_util.h b/src/oidc_child/oidc_child_util.h index c781bf1b1..ae5a72bc2 100644 --- a/src/oidc_child/oidc_child_util.h +++ b/src/oidc_child/oidc_child_util.h @@ -61,6 +61,8 @@ struct devicecode_ctx { }; /* oidc_child_curl.c */ +char *url_encode_string(TALLOC_CTX *mem_ctx, const char *inp); + errno_t init_curl(void *p); void clean_http_data(struct devicecode_ctx *dc_ctx); -- 2.37.3