sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-29 19:11:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into peer-acl-multi-source

Browse Source 
# Conflicts:
#	client/firewall/nftables/router_linux.go
#	client/firewall/uspfilter/filter.go
This commit is contained in:
Viktor Liu
2026-07-31 22:07:04 +02:00
parent 58a8a69406 0780a806f2
commit 3df2b170ba
484 changed files with 34762 additions and 8263 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
client/ssh/server/getent_unix.go
View File

@@ -69,7 +69,8 @@ func parseGetentPasswd(output string) (*user.User, string, error) {
// validateGetentInput checks that the input is safe to pass to getent or id.
// Allows POSIX usernames, numeric UIDs, and common NSS extensions
// (@ for Kerberos, $ for Samba, + for NIS compat).
// (@ for Kerberos, $ for Samba, + for NIS compat). A leading hyphen is
// rejected so the input can never be parsed as a command-line flag.
func validateGetentInput(input string) bool {
maxLen := 32
if runtime.GOOS == "linux" {
@@ -80,6 +81,10 @@ func validateGetentInput(input string) bool {
return false
}
if input[0] == '-' {
return false
}
for _, r := range input {
if isAllowedGetentChar(r) {
continue

3
client/ssh/server/getent_unix_test.go
View File

@@ -157,6 +157,9 @@ func TestValidateGetentInput(t *testing.T) {
{"numeric UID", "1001", true},
{"dots and underscores", "alice.bob_test", true},
{"hyphen", "alice-bob", true},
{"leading hyphen rejected", "-i", false},
{"leading double hyphen rejected", "--no-idn", false},
{"lone hyphen rejected", "-", false},
{"kerberos principal", "user@REALM", true},
{"samba machine account", "MACHINE$", true},
{"NIS compat", "+user", true},