Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cvtsudoers generates invalid JSON when aliases do not resolve #381

Closed
qkaiser opened this issue Jun 7, 2024 · 1 comment
Closed

cvtsudoers generates invalid JSON when aliases do not resolve #381

qkaiser opened this issue Jun 7, 2024 · 1 comment

Comments

@qkaiser
Copy link

qkaiser commented Jun 7, 2024

Bug Description

When parsing a sudoers containing an alias that does not resolve, cvtsudoers will generate invalid JSON output.

With the reduced test case below:

User_Alias  CLI_USER = cli
Defaults:CLI_USR	!lecture

The following JSON output is generated:

cvtsudoers -f json --expand-aliases /tmp/crash.sudoers
{
    "Defaults": [
        {
            "Binding": [
            ] <----- missing comma here
            "Options": [
                { "lecture": false }
            ]
        }
    ]
}

I took some traces and this is the behavior with an alias that resolves:

   120 ms     | sudo_json_open_array_v1()
   120 ms     |    | json_new_line()
   120 ms     |    | json_append_string()
   120 ms     |    |    | json_append_buf()
   120 ms     |    |    | json_append_buf()
   120 ms     |    |    | json_append_buf()
   120 ms     |    |    | json_append_buf()
   120 ms     |    |    | json_append_buf()
   120 ms     |    |    | json_append_buf()
   120 ms     |    |    | json_append_buf()
   120 ms     |    |    | json_append_buf()
   120 ms     |    |    | json_append_buf()
   120 ms     |    | json_append_buf()
   120 ms     | print_member_json_int()
   120 ms     | sudo_json_close_array_v1()
   120 ms     |    | json_new_line()
   120 ms     |    | json_append_buf()
   120 ms     | sudo_json_open_array_v1()

and the behavior with an alias that does not resolve:

    97 ms     | sudo_json_open_array_v1()
    97 ms     |    | json_new_line()
    97 ms     |    | json_append_string()
    97 ms     |    |    | json_append_buf()
    97 ms     |    |    | json_append_buf()
    98 ms     |    |    | json_append_buf()
    98 ms     |    |    | json_append_buf()
    98 ms     |    |    | json_append_buf()
    98 ms     |    |    | json_append_buf()
    98 ms     |    |    | json_append_buf()
    98 ms     |    |    | json_append_buf()
    98 ms     |    |    | json_append_buf()
    98 ms     |    | json_append_buf()
    98 ms     | print_member_json_int()
    98 ms     |    | print_member_json_int()
    98 ms     |    |    | sudo_json_add_value_as_object_v1()
    98 ms     |    |    |    | sudo_json_add_value_int()
    98 ms     |    |    |    |    | json_new_line()
    98 ms     |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    | json_append_string()
    98 ms     |    |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    | json_append_string()
    98 ms     |    |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    |    | json_append_buf()
    98 ms     |    |    |    |    | json_append_buf()
    98 ms     | sudo_json_close_array_v1()
    98 ms     |    | json_new_line()
    98 ms     |    | json_append_buf()
    98 ms     | sudo_json_open_array_v1()

Affected Software Version

cvtsudoers version 1.9.9
cvtsudoers grammar version 48

And also tested with the latest commit as of now (648ce41).

Background Information

We're scanning large amounts of sudoers files from a firmware corpus. We noticed that behavior when looking into --expand-alias.

millert added a commit that referenced this issue Jun 7, 2024
This fixes an issue where an empty array or object would not have
a comma after it.  GitHub issue #381
millert added a commit that referenced this issue Jun 7, 2024
This matches the behavior of the sudoers parser.  There is no way
to tell for sure if an upper case word is an alias or a user or
host name.  An unresolvable command alias is never a command since
it doesn't start with a '/'.  GitHub issue #381
@millert
Copy link
Collaborator

millert commented Jun 7, 2024

Thanks for the report. This is fixed by 4e1c587.

@millert millert closed this as completed Jun 7, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants