Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

OAuth (bearer) quota check denies every user when the allowed-user list is empty

未关闭 适合新手
  • 哪里不对？
#1,795 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
66/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
c
领域
authorization, backend

调研方向

从 scheduler/ipp.c 中的 add_job() 开始，阅读其中的提前返回和第 3876-3915 行附近的 bearer 分支，然后与第 3916 行受保护的非 bearer 分支进行比较。问题在于，当允许用户列表为空时仍会执行 bearer 比较，因此设置了作业配额的打印机会拒绝所有 OAuth 用户。完成标准是：空的允许列表与非 bearer 路径一样允许 OAuth 用户。验证方法是：在没有用户列表的打印机上设置作业配额，然后提交一个使用 bearer 认证的作业。

由索引模型根据 Issue 内容生成。

描述

Summary
Before checking the allowed-user list, add_job() returns early only when the list is empty and both quotas are zero. A printer that has a quota set therefore proceeds with an empty list. The non-bearer path then guards the comparison with cupsArrayCount(p->users), so an empty list means "no restriction". The bearer path does not guard it: the loop over the empty list leaves name as NULL, and the comparison at 3910 evaluates (name != NULL) == p->deny_users, which is true for the default allow-list, so every OAuth user is refused.

Affected code: scheduler/ipp.c:3876–3915, specifically the early-out at 3876–3877, the bearer branch at 3879, the unguarded comparison at 3910, and the guarded non-bearer branch at 3916. Unchanged in current master 3949d140567cf7b6cede1ea48e4ca6db92066c91.

Reachable rejection sequence

  1. A printer is configured with a quota, for example lpadmin -p printer1 -o job-k-limit=100, and its allowed-user list is left empty — the ordinary way to mean "anyone may print".
  2. The early-out at 3876 does not apply, because the quota is non-zero even though the list is empty.
  3. cupsdDefaultAuthType() is CUPSD_AUTH_BEARER, so execution enters the branch at 3879.
  4. The loop at 3885 does not execute, since p->users is empty; name keeps its NULL value.
  5. Line 3910 evaluates (0) == p->deny_users. With the list used as an allow-list, deny_users is false, so the comparison is true and line 3913 refuses the job.
  6. The same printer accepts the identical request over any non-bearer authentication path, because that branch is only entered when the list is non-empty (3916).

The result is that a quota-limited printer is unusable for OAuth users, and the log line reads "Denying user ... access to printer ...", which suggests an access-control decision rather than a missing empty-list case. Nothing is granted that should not be, so this is functional rather than a bypass.

Suggested fix
Guard the comparison the same way the non-bearer branch does.

-    if ((name != NULL) == p->deny_users)
+    if (cupsArrayCount(p->users) > 0 && (name != NULL) == p->deny_users)

Two neighbouring issues in the same function, not worth separate reports but visible in the same code: at 4009–4021 a failed mbr_user_name_to_uuid() is logged and the loop continues to uuid_compare() with usr2_uuid unset on the first pass, where a continue is expected; and at 3967–3994 a failed group-name conversion does not clear grp_uuid before mbr_check_membership(), unlike the @# branch above it. Both compile only in HAVE_MBR_UID_TO_UUID builds.

主要语言
C
星标
1.8k
派生
353
平均合并
19 小时 41 分钟
30 天内合并 PR
18

环境准备

  • 提供 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

OpenPrinting/cups 的其他 Issue

查看 OpenPrinting/cups 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。