python-ldap-dev

Very strange problem with module ldapurl

[<mi...@st...>]

HI!

I have a very strange problem with ldapurl (my own source, sigh!) which 
can also be a security problem in case of passwords stored in 
LDAPUrlExtension instances. It drives me crazy!

See this simple source:

------------------------ snip ------------------------
from ldapurl import LDAPUrl,LDAPUrlExtension

l1=LDAPUrl()
l1.hostport='host1'
l1.who='cn=User1'
l1.cred='passwd1'
l1.extensions['dummyext1']=LDAPUrlExtension(
   extype='dummyext1',exvalue='dummyvalue1'
)

print 'l1 before creation of l2:\n',str(l1)

l2=LDAPUrl()
l2.hostport='host2'
l2.who='cn=User2'
l2.cred='passwd2'
l2.extensions['dummyext2']=LDAPUrlExtension(
   extype='dummyext2',exvalue='dummyvalue2'
)

print 'l1 after creation of l2:\n',str(l1)
print 'l2 itself:\n',str(l2)
------------------------ snip ------------------------

In theory l1 and l2 should be completely independent LDAPUrl instances. 
But it seems the LDAPUrl.extensions class attributes are tied by some means.

The problem is the output (with Python 2.2.1):

$ python Tests/ldapurl_instance_error.py
ldap://host1/????dummyext2=dummyvalue2,dummyext1=dummyvalue1,bindname=cn=User2,X-BINDPW=passwd2
ldap://host2/????dummyext2=dummyvalue2,dummyext1=dummyvalue1,bindname=cn=User2,X-BINDPW=passwd2

Anybody here having a clue?

Ciao, Michael.

Re: Very strange problem with module ldapurl

[Jens V. <je...@zo...>]

i was stepping through the creation of l2 in the debugger, and to aid =20=

this i made the following change::

Index: ldapurl.py
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
RCS file: /cvsroot/python-ldap/python-ldap/Lib/ldapurl.py,v
retrieving revision 1.26
diff -r1.26 ldapurl.py
229c229
<     extensions=3DLDAPUrlExtensions({}),
---
 >     extensions=3DNone,
238c238
<     self.extensions=3Dextensions
---
 >     self.extensions=3Dextensions or LDAPUrlExtensions({})

i basically moved the creation of that LDAPUrlExtensions object from =20
the argument list into the function itself. that solved the problem for =20=

me it seems. here is my output now::

l1 before creation of l2:
ldap://host1/????X-=20
BINDPW=3Dpasswd1,dummyext1=3Ddummyvalue1,bindname=3Dcn=3DUser1
l1 after creation of l2:
ldap://host1/????X-=20
BINDPW=3Dpasswd1,dummyext1=3Ddummyvalue1,bindname=3Dcn=3DUser1
l2 itself:
ldap://host2/????X-=20
BINDPW=3Dpasswd2,dummyext2=3Ddummyvalue2,bindname=3Dcn=3DUser2

hmmm.... :)

jens


On Friday, Sep 6, 2002, at 14:27 US/Eastern, Michael Str=F6der wrote:

> HI!
>
> I have a very strange problem with ldapurl (my own source, sigh!) =20
> which can also be a security problem in case of passwords stored in =20=

> LDAPUrlExtension instances. It drives me crazy!
>
> See this simple source:
>
> ------------------------ snip ------------------------
> from ldapurl import LDAPUrl,LDAPUrlExtension
>
> l1=3DLDAPUrl()
> l1.hostport=3D'host1'
> l1.who=3D'cn=3DUser1'
> l1.cred=3D'passwd1'
> l1.extensions['dummyext1']=3DLDAPUrlExtension(
>   extype=3D'dummyext1',exvalue=3D'dummyvalue1'
> )
>
> print 'l1 before creation of l2:\n',str(l1)
>
> l2=3DLDAPUrl()
> l2.hostport=3D'host2'
> l2.who=3D'cn=3DUser2'
> l2.cred=3D'passwd2'
> l2.extensions['dummyext2']=3DLDAPUrlExtension(
>   extype=3D'dummyext2',exvalue=3D'dummyvalue2'
> )
>
> print 'l1 after creation of l2:\n',str(l1)
> print 'l2 itself:\n',str(l2)
> ------------------------ snip ------------------------
>
> In theory l1 and l2 should be completely independent LDAPUrl =20
> instances. But it seems the LDAPUrl.extensions class attributes are =20=

> tied by some means.
>
> The problem is the output (with Python 2.2.1):
>
> $ python Tests/ldapurl_instance_error.py
> ldap://host1/=20
> ????dummyext2=3Ddummyvalue2,dummyext1=3Ddummyvalue1,bindname=3Dcn=3DUser=
2,X-=20
> BINDPW=3Dpasswd2
> ldap://host2/=20
> ????dummyext2=3Ddummyvalue2,dummyext1=3Ddummyvalue1,bindname=3Dcn=3DUser=
2,X-=20
> BINDPW=3Dpasswd2
>
> Anybody here having a clue?
>
> Ciao, Michael.
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by: OSDN - Tired of that same old
> cell phone?  Get a new here for FREE!
> https://www.inphonic.com/r.asp?r=3Dsourceforge1&refcode1=3Dvs3390
> _______________________________________________
> Python-LDAP-dev mailing list
> Pyt...@li...
> https://lists.sourceforge.net/lists/listinfo/python-ldap-dev

Re: Very strange problem with module ldapurl

[Jens V. <je...@zo...>]

i just got confirmation from someone here at zope corp who knows these =20=

things better that...

- in general, it is better to avoid mutable default values in an =20
argument list for a method

- the fact that the LDAPUrlExtensions-constructor was part of the =20
arguemnt list would actually give you the very same object every single =20=

time.

jens


On Friday, Sep 6, 2002, at 14:27 US/Eastern, Michael Str=F6der wrote:

> HI!
>
> I have a very strange problem with ldapurl (my own source, sigh!) =20
> which can also be a security problem in case of passwords stored in =20=

> LDAPUrlExtension instances. It drives me crazy!
>
> See this simple source:
>
> ------------------------ snip ------------------------
> from ldapurl import LDAPUrl,LDAPUrlExtension
>
> l1=3DLDAPUrl()
> l1.hostport=3D'host1'
> l1.who=3D'cn=3DUser1'
> l1.cred=3D'passwd1'
> l1.extensions['dummyext1']=3DLDAPUrlExtension(
>   extype=3D'dummyext1',exvalue=3D'dummyvalue1'
> )
>
> print 'l1 before creation of l2:\n',str(l1)
>
> l2=3DLDAPUrl()
> l2.hostport=3D'host2'
> l2.who=3D'cn=3DUser2'
> l2.cred=3D'passwd2'
> l2.extensions['dummyext2']=3DLDAPUrlExtension(
>   extype=3D'dummyext2',exvalue=3D'dummyvalue2'
> )
>
> print 'l1 after creation of l2:\n',str(l1)
> print 'l2 itself:\n',str(l2)
> ------------------------ snip ------------------------
>
> In theory l1 and l2 should be completely independent LDAPUrl =20
> instances. But it seems the LDAPUrl.extensions class attributes are =20=

> tied by some means.
>
> The problem is the output (with Python 2.2.1):
>
> $ python Tests/ldapurl_instance_error.py
> ldap://host1/=20
> ????dummyext2=3Ddummyvalue2,dummyext1=3Ddummyvalue1,bindname=3Dcn=3DUser=
2,X-=20
> BINDPW=3Dpasswd2
> ldap://host2/=20
> ????dummyext2=3Ddummyvalue2,dummyext1=3Ddummyvalue1,bindname=3Dcn=3DUser=
2,X-=20
> BINDPW=3Dpasswd2
>
> Anybody here having a clue?
>
> Ciao, Michael.