auth: db-lua - Skip invalid keys and values on field export

diff --git a/src/auth/db-lua.c b/src/auth/db-lua.c
index dd4e77b25f0a060914c0115728813a297e38c82f..e31d5d9baa199c8dbc6a8e5786a828f9efa71a4a 100644 (file)
--- a/src/auth/db-lua.c
+++ b/src/auth/db-lua.c
@@ -8,6 +8,7 @@
 #include "array.h"
 #include "sha1.h"
 #include "hex-binary.h"
+#include "strescape.h"
 #include "auth.h"
 #include "passdb.h"
 #include "userdb.h"
@@ -472,6 +473,19 @@ static void auth_lua_export_table(lua_State *L, struct auth_request *req,
        lua_pushnil(L);
        while (lua_next(L, -2) != 0) {
                const char *key = t_strdup(lua_tostring(L, -2));
+               if (*key == '\0') {
+                       e_warning(authdb_event(req),
+                                 "db-lua: Field key cannot be empty - ignoring");
+                       lua_pop(L, 1);
+                       continue;
+               }
+               if (strpbrk(key, "\t\n\r") != NULL) {
+                       e_warning(authdb_event(req),
+                                 "db-lua: Field key cannot contain <CR>, <LF> or <TAB> - ignoring");
+                       lua_pop(L, 1);
+                       continue;
+               }
+
                const char *value;
                int type = lua_type(L, -1);
                switch(type) {
@@ -491,10 +505,12 @@ static void auth_lua_export_table(lua_State *L, struct auth_request *req,
                        e_warning(authdb_event(req),
                                  "db-lua: '%s' has invalid value type %s - ignoring",
                                  key, lua_typename(L, -1));
-                       value = "";
+                       value = NULL;
                }
 
-               if (password_r != NULL && strcmp(key, "password") == 0) {
+               if (value == NULL) {
+                       /* do not add */
+               } else if (password_r != NULL && strcmp(key, "password") == 0) {
                        *scheme_r = password_get_scheme(&value);
                        *password_r = value;
                } else if (req->userdb_lookup) {