Bug 45386 - mapping_table: TypeError: 'unicode' object does not support item assignment
mapping_table: TypeError: 'unicode' object does not support item assignment
Status: RESOLVED WORKSFORME
Product: UCS
Classification: Unclassified
Component: AD Connector
UCS 5.0
Other Linux
: P5 normal (vote)
: ---
Assigned To: Samba maintainers
Samba maintainers
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-09-13 21:10 CEST by Arvid Requate
Modified: 2021-02-01 21:14 CET (History)
1 user (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 3: Simply Wrong: The implementation doesn't match the docu
Who will be affected by this bug?: 1: Will affect a very few installed domains
How will those affected feel about the bug?: 2: A Pain – users won’t like this once they notice it
User Pain: 0.034
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:


Attachments
mapping_table.patch (1.55 KB, patch)
2017-09-13 21:10 CEST, Arvid Requate
Details | Diff
mapping_table_re.patch (2.53 KB, patch)
2017-09-13 21:27 CEST, Arvid Requate
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2017-09-13 21:10:45 CEST
Created attachment 9193 [details]
mapping_table.patch

When there is a group in AD that contains one of the strings listed in the /etc/univention/connector/ad/mapping.py "mapping_table" dictionary as a substring, then a traceback occurs during sync_to_ucs:

===========================================================================
13.09.2017 15:09:03,342 LDAP        (ERROR  ): failed in post_con_modify_functions
13.09.2017 15:09:03,344 LDAP        (ERROR  ): Traceback (most recent call last):
  File "/usr/lib/pymodules/python2.7/univention/connector/__init__.py", line 1326, in sync_to_ucs
    f(self, property_type, object)
  File "/usr/lib/pymodules/python2.7/univention/connector/ad/__init__.py", line 121, in primary_group_sync_to_ucs
    return connector.primary_group_sync_to_ucs(key, object)
  File "/usr/lib/pymodules/python2.7/univention/connector/ad/__init__.py", line 1382, in primary_group_sync_to_ucs
    ucs_group = self._object_mapping('group', {'dn': ldap_group_ad[0][0], 'attributes': ldap_group_ad[0][1]})
  File "/usr/lib/pymodules/python2.7/univention/connector/__init__.py", line 1694, in _object_mapping
    object_out['attributes'][self.property[key].attributes[attr_key].ldap_attribute][objectval_lower.index(conval_lower)] = ucsval
TypeError: 'unicode' object does not support item assignment
===========================================================================

The code doesn't seem to be correct, it's trying to do a substring replace by treating a string like an array. Looks like somebody tried to write C here. My current impression is that this can never have worked. I guess this code path was never used, because samaccountname_dn_mapping already uses the mapping_table, but only for exact matches. In my case I had a substring match, so I ended up here.

The attached patch at least removes the functionality of substring replacement. Alternatively we should use re.compile with re.IGNORECASE and do a pattern.sub.
Comment 1 Arvid Requate univentionstaff 2017-09-13 21:27:19 CEST
Created attachment 9194 [details]
mapping_table_re.patch

This would be an alternative, using case insensitive re substring replace.
Comment 2 Florian Best univentionstaff 2017-09-13 22:14:09 CEST
Comment on attachment 9194 [details]
mapping_table_re.patch

> +										case_insensitive_conval = re.compile(conval, re.IGNORECASE)
this seems wrong, it needs to be:
+										case_insensitive_conval = re.compile(re.escape(conval), re.IGNORECASE)
Comment 3 Arvid Requate univentionstaff 2017-09-14 00:34:42 CEST
Yes, I know, I prefer removing the code anyway.
Comment 4 Florian Best univentionstaff 2021-02-01 21:14:50 CET
Both patches are wrong.

ucsval_lower is a string.
objectval_lower is a list of strings.

Patch "if ucsval_lower == objectval_lower:" would always be false, resulting in dead code.
Patch regex (re.sub('.*', 'foo', ['bar'], count=1)): would result in: TypeError: expected string or buffer

The problem here is that the check is wrong:
> if isinstance(object_out['attributes'][self.property[key].attributes[attr_key].con_attribute], type([])):
> …
>     objectval_lower = make_lower(object_out['attributes'][self.property[key].attributes[attr_key].ldap_attribute])

con_attribute VS ldap_attribute.

So the code was called for an ldap_attribute which was not a list but a string. - how could that happen?

Well, NVM. With UCS 5.0 this bug can't occur anymore.