(ITS#4382) slurpd remote error sanitization

[lucca@csun.edu]

Full_Name: Matthew Backes
Version: 2.2, 2.3, HEAD, probably older
OS: n/a
URL: 
Submission from: (NULL) (130.166.10.75)


If a remote server returns an error to slurpd containing non-ldif clean output,
slurpd does not perform any escaping before writing the reject log.

The resulting reject log is not parsable by slurpd or ldapmodify.

Certain other directories tend to output linefeeds in errmsgs, resulting in
pieces of those errors appearing amidst the other attributes or as a separate
object.

This could be a security concern if someone were using slurpd replication,
replicating to untrusted foreign directories, and performing automated
reprocessing of the reject logs, but that is a rather far-fetched scenario.  I
suppose one could use it to emit replication events pointing to other
directories or use the ldif file-include syntax to include files visible on the
master directory.

I'm submitting this ITS so that future slurpd replacements will be aware of the
problem.