Re: truncated mech names are accepted - a bug?

On 14/03/2014 14:42, Petr Lautrbach wrote:
> Hello,
Hi Petr,
> A server with this configuration:
> mech_list: A
>
> shows 'ANONYMOUS' in available mechanisms.
>
> It's due to the fact that _sasl_is_equal_mech() compares plug_mech only with the first strlen(req_mech) characters of plug_mech:
> lib/common.c:2431:    return (strncasecmp(req_mech, plug_mech, n) == 0);
>
> where n is (usually) an equivalent of strlen(req_mech)
>
> For ANONYMOUS, it means that any string from the following set of
>   {A, AN, ..., ANONYMOU, ANONYMOUS} will match ANONYMOUS.
Actually, the way code is structured, all prefixes up to 4 characters 
will match and the rest will not. Which is probably worse from the 
consistency point of view.
> The fix could be to first compare the length of plug_mech with 'n'.
>
> This might be also a feature - to allow multiple plugin mechanism using one mech_list string,
> but it doesn't feel right for me as I haven't found any documentation about that.
You right, this looks like a bug. I will fix.