Bug 780 – visudo does not catch UTF-8 EN SPACE characters

Bug 780 - visudo does not catch UTF-8 EN SPACE characters


Summary:	visudo does not catch UTF-8 EN SPACE characters

Status:	ASSIGNED

Product:	Sudo
Classification:	Unclassified
Component:	Visudo
Version:	1.8.10
Hardware:	PC Linux

Importance:	low normal
Assigned To:	Todd C. Miller

URL:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2017-03-20 07:05 MDT by Sebastian Wiesinger
Modified:	2017-05-08 13:20 MDT (History)
CC List:	0 users

See Also:

Attachments
sudoers UTF-8 example (121 bytes, text/plain) 2017-03-20 07:05 MDT, Sebastian Wiesinger	Details
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sebastian Wiesinger 2017-03-20 07:05:59 MDT

Created attachment 489 [details]
sudoers UTF-8 example

While trying to enter new sudo entries into a sudoers file someone pasted a line that had UTF-8 EN SPACE (U+2002) chars instead of "normal" 0x20 space chars. This was not visible and not detected by visudo. The lines where then not used and not visible while doing sudo -l.

I'm attaching an example file with the offending lines.

Comment 1 Todd C. Miller 2017-04-12 08:22:28 MDT

In this case the UTF-8 characters are treated as part of the username since sudoers is parsed in the  C locale by default.  The least surprising thing may be for the sudoers parser to treat the various UTF-8 space characters as blanks regardless of the sudoers locale.