[Bug 2127080] Re: [SRU] sudo-rs does not accept escaped characters in command-line arguments

[Julian Andres Klode]

Hello Simon, or anyone else affected,

Accepted rust-sudo-rs into questing-proposed. The package will build now
and be available at https://launchpad.net/ubuntu/+source/rust-sudo-
rs/0.2.8-1ubuntu5.1 in a few hours, and then in the -proposed
repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, what testing has been
performed on the package and change the tag from verification-needed-
questing to verification-done-questing. If it does not fix the bug for
you, please add a comment stating that, and change the tag to
verification-failed-questing. In either case, without details of your
testing we will not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: rust-sudo-rs (Ubuntu Questing)
       Status: New => Fix Committed

** Tags added: verification-needed verification-needed-questing

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to rust-sudo-rs in Ubuntu.
https://bugs.launchpad.net/bugs/2127080

Title:
  [SRU] sudo-rs does not accept escaped characters in command-line
  arguments

Status in rust-sudo-rs package in Ubuntu:
  In Progress
Status in rust-sudo-rs source package in Questing:
  Fix Committed

Bug description:
  [ Impact ]

  The bug prevents sudoers files from including an escaped equal sign in
  command arguments. Example:

  ```
  # This is currently allowed
  Cmd_Alias FOO_CMD = /bin/foo --bar=1
  # ...this gives a syntax error
  Cmd_Alias BAR_CMD = /bin/foo --bar\=1
  ```

  The behavior is a regression following the previous fix in version
  0.2.8-1ubuntu4, which allowed un-escaped equal signs.

  This upload fixes the issue by both setting '=' as an escaped symbol
  in commands and adding it as an accepted un-escaped symbol.

  [ Test Plan ]

  1) Create a file called 'test' with the following contents:
  ```
  Cmd_Alias FOO_CMD = /bin/foo --bar=1
  Cmd_Alias BAR_CMD = /bin/foo --bar\=1
  ```
  2) Run visudo on 'test':
  ```shell
  visudo -c -f test
  ```
  3) File should parse successfully

  [ Where problems could occur ]

  Potential problems would arise in the parsing of commands in sudoers files, in  cases where an escaped equal sign is considered illegal syntax.
  Problems could also include unpredicted side effects in command parsing when "\=" is used erroneously.

  [ Original description ]
  In rust-sudo-rs 0.2.8-1ubuntu4 a fix was introduced that allowed for '=' to be used in commands as such:

  Cmd_Alias FOO_CMD = /bin/foo --bar=1

  However, this fix also made the escaped equivalence generate an
  "illegal escape sequence error":

  Cmd_Alias BAR_CMD = /bin/foo --bar\=1

  -------------------------------------

  Steps to reproduce:

  1. Create a file called "test" with the following content:

  Cmd_Alias FOO_CMD = /bin/foo --bar=1
  Cmd_Alias BAR_CMD = /bin/foo --bar\=1

  2. Run visudo on the file:

  $ visudo -c -f test

  3. An error is given:

  test:2:36: syntax error: illegal escape sequence
  Cmd_Alias BAR_CMD = /bin/foo --bar\=1
                                     ^
  visudo: invalid sudoers file

  -------------------------------------

  What I expect to happen:

  The sudoers file is parsed correctly without an error.

  Release: Ubunutu 25.10
  sudo-rs version: 0.2.8-1ubuntu5

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rust-sudo-rs/+bug/2127080/+subscriptions