Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Principal name parsing does not handle backslash escapes/quoting #520

Open
nicowilliams opened this issue May 19, 2023 · 1 comment
Open

Comments

@nicowilliams
Copy link

The textual form of principal names that most implementations use (and thus what we all have to interoperate with) is given in RFC 1964, section 2.1.1:

image
image

Most importantly @, /, and \ in principal name components need to be backslash-escaped, and @ in realm names also needs to be backslash-escaped. There's also whitespace characters (newline, tab), backspace, and embedded NULs that must be expressed as \n, \t, \b, and \0 respectively, though commonly implementations disallow embedded NULs, and I have never ever seen any principals with newline, tab, or backspace in them, but principals with @ in a component do happen. Specifically, the ill-named concept of User Principal Name (UPN), which is really name\@domain@REALM does require backslash-escaping of @ in order to parse correctly.

I recommend at least handling backslash-escaping of / in principal name components, and @ in principal name components and realm names.

https://github.com/jcmturner/gokrb5/blob/master/types/PrincipalName.go#L22
https://github.com/jcmturner/gokrb5/blob/master/types/PrincipalName.go#L49
https://github.com/jcmturner/gokrb5/blob/master/types/PrincipalName.go#L58

@nicowilliams
Copy link
Author

BTW, I'm quite impressed with this codebase. Keep it up!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant