Skip to content

_walk_group_ancestry() from LdapFluff::ActiveDirectory::MemberService can recurse in an infinite loop #51

Description

@elatt

It seems that our IT admins have created a cyclic group membership (where Group A has Group B as a member but Group B also has Group A as a member). While I doubt this type of configuration advised, it seems it is legal so I think _walk_group_ancestry() should have some sort of cycle detection otherwise it eventually blows up the stack and raises an exception. I propose that the function should be made tail-recursive by rather than returning a list, it should take a last and use that to accumulate data. Then I think we can check to see if the current group we are processing already exists inside our accumulated list of groups and if it does we know that we are starting to cycle and we can break out.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    Red Hat Jira

    None yet

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions