[INFRA-2178] No size limit in Last name

[jenkins-infra-bot]

Hi Team,

 

Steps to Reproduce vulnerability

>> intially Generate character from http://www.unit-conversion.info/texttools/random-string-generator/

 

>> Generate 1000 characters and copy that

>> now go to https://accounts.jenkins.io/

>> Then Profile

>> In Last Name .Paste that generated character ...intercept that ...we can see that there is no size limit of characher

 

---

Originally reported by punk_solta123, imported from: No size linit in Last name

• assignee: olblak
• status: Open
• priority: Critical
• resolution: Unresolved
• imported: 2022/01/10

[jenkins-infra-bot]

oleg_nenashev:

CC Daniel Beck Olivier Vernin

[jenkins-infra-bot]

hlemeur:

Olivier Vernin is this issue still relevant?

[MUCCHU]

I was able to reproduce this issue. Would you like me to work on it?

[dduportal]

@MUCCHU if you plan to work on it, it means you are expected to be autonomous in understanding the problem and fixing it.

[MUCCHU]

Sure, i get it. I awaiting review on my Pull Request that I submitted today. I will work on this once that request is closed. Thanks

[MUCCHU]

I can't get the LDAP server running. The docker-compose up ldap gives this:

➜ docker compose up ldap
WARN[0000] /home/mucchu/Github/JenkinsInfra/account-app/docker-compose.yaml: the attribute `version` is obsolete, it will be ignored, please remove it to avoid potential confusion 
[+] Running 0/1
 ⠏ ldap Pulling                                                                                                     4.0s 
[DEPRECATION NOTICE] Docker Image Format v1 and Docker Image manifest version 2, schema 1 support is disabled by default and will be removed in an upcoming release. Suggest the author of docker.io/jenkinsciinfra/mock-ldap:latest to upgrade the image to the OCI Format or Docker Image manifest v2, schema 2. More information at https://docs.docker.com/go/deprecated-image-specs/

I tried using another LDAP image( jenkinsciinfra/ldap) by jenkins provided on the docker hub, but it asks for a private key:

➜ docker compose up ldap
[+] Running 1/1
 ✔ Container account-app-ldap-1  Created                                                                            0.0s 
Attaching to ldap-1
ldap-1  | /entrypoint/functions: line 13: exit: File /etc/ldap/ssl/privkey.key doesn't exist: numeric argument required
ldap-1 exited with code 2

setting this LDAP_TLS=false environment variable didn't help either.

[timja]

indicates that mock-ldap needs to be rebuilt, you can probably work around it locally by rebuilding the image in https://github.com/jenkins-infra/mock-ldap

[MUCCHU]

Ohh, I will try it.

[dduportal]

Reopening as the fix is not in production yet.