@synopackageland/cli 0.4.1 → 0.5.3

package/dist/templates/_gateway/cgi.go

@@ -0,0 +1,133 @@
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"time"
+)
+
+// serveCGI answers one request the way net/http/cgi.Serve does: "Status:" and headers, a blank line, the body
+// on `out`. It is its own copy so that the reply can be hijacked: the handler then owns `in` and `out`, which
+// is how a WebSocket passes through DSM's CGI interface.
+func serveCGI(h http.Handler, req *http.Request, in io.Reader, out io.Writer) error {
+	if req.Body == nil {
+		req.Body = http.NoBody
+	}
+	rw := &cgiResponse{req: req, header: make(http.Header), in: in, out: out, bufw: bufio.NewWriter(out)}
+	h.ServeHTTP(rw, req)
+	if rw.hijacked {
+		return nil
+	}
+	rw.Write(nil) // make sure a reply is sent
+	return rw.bufw.Flush()
+}
+
+type cgiResponse struct {
+	req         *http.Request
+	header      http.Header
+	code        int
+	wroteHeader bool
+	wroteCGI    bool
+	hijacked    bool
+	in          io.Reader
+	out         io.Writer
+	bufw        *bufio.Writer
+}
+
+func (r *cgiResponse) Header() http.Header { return r.header }
+
+func (r *cgiResponse) Flush() {
+	if !r.hijacked {
+		r.bufw.Flush()
+	}
+}
+
+func (r *cgiResponse) WriteHeader(code int) {
+	if r.wroteHeader {
+		return
+	}
+	r.wroteHeader, r.code = true, code
+}
+
+func (r *cgiResponse) Write(p []byte) (int, error) {
+	if r.hijacked {
+		return 0, http.ErrHijacked
+	}
+	if !r.wroteHeader {
+		r.WriteHeader(http.StatusOK)
+	}
+	if !r.wroteCGI {
+		r.writeCGIHeader(p)
+	}
+	return r.bufw.Write(p)
+}
+
+// writeCGIHeader sends the header block; p, the first chunk of the body, is sniffed for a missing Content-Type.
+func (r *cgiResponse) writeCGIHeader(p []byte) {
+	r.wroteCGI = true
+	fmt.Fprintf(r.bufw, "Status: %d %s\r\n", r.code, http.StatusText(r.code))
+	if _, hasType := r.header["Content-Type"]; !hasType {
+		r.header.Set("Content-Type", http.DetectContentType(p))
+	}
+	r.header.Write(r.bufw)
+	r.bufw.WriteString("\r\n")
+	r.bufw.Flush()
+}
+
+// Hijack hands stdin and stdout to the handler. The first thing it writes is an HTTP/1.1 status line and
+// headers (that is what httputil.ReverseProxy writes for a 101); the CGI interface wants "Status: 101 ..."
+// there, so cgiConn rewrites the status line and leaves everything after the blank line alone.
+func (r *cgiResponse) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	if r.wroteHeader || r.wroteCGI || r.hijacked {
+		return nil, nil, errors.New("cgi: Hijack after the reply began")
+	}
+	r.hijacked = true
+	c := &cgiConn{in: r.in, out: r.out}
+	return c, bufio.NewReadWriter(bufio.NewReader(c), bufio.NewWriter(c)), nil
+}
+
+type cgiConn struct {
+	in       io.Reader
+	out      io.Writer
+	head     []byte // the header block, held back until it is complete
+	headSent bool
+}
+
+func (c *cgiConn) Read(p []byte) (int, error) { return c.in.Read(p) }
+
+func (c *cgiConn) Write(p []byte) (int, error) {
+	if c.headSent {
+		return c.out.Write(p)
+	}
+	c.head = append(c.head, p...)
+	end := bytes.Index(c.head, []byte("\r\n\r\n"))
+	if end < 0 {
+		return len(p), nil
+	}
+	c.headSent = true
+	statusLine, headers, _ := bytes.Cut(c.head[:end+4], []byte("\r\n"))
+	_, status, _ := bytes.Cut(statusLine, []byte(" ")) // "HTTP/1.1 101 Switching Protocols" -> "101 Switching Protocols"
+	rewritten := append(append([]byte("Status: "), status...), "\r\n"...)
+	rewritten = append(append(rewritten, headers...), c.head[end+4:]...)
+	if _, err := c.out.Write(rewritten); err != nil {
+		return 0, err
+	}
+	return len(p), nil
+}
+
+func (c *cgiConn) Close() error                     { return nil }
+func (c *cgiConn) LocalAddr() net.Addr              { return cgiAddr{} }
+func (c *cgiConn) RemoteAddr() net.Addr             { return cgiAddr{} }
+func (c *cgiConn) SetDeadline(time.Time) error      { return nil }
+func (c *cgiConn) SetReadDeadline(time.Time) error  { return nil }
+func (c *cgiConn) SetWriteDeadline(time.Time) error { return nil }
+
+type cgiAddr struct{}
+
+func (cgiAddr) Network() string { return "cgi" }
+func (cgiAddr) String() string  { return "cgi" }

package/dist/templates/_gateway/cgi_test.go

@@ -0,0 +1,156 @@
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func cgiRequest(t *testing.T) *http.Request {
+	t.Helper()
+	return httptest.NewRequest("GET", "/webman/3rdparty/App/cgi/gateway.cgi/", nil)
+}
+
+func TestCGIReplyIsAStatusLineThenHeadersThenBody(t *testing.T) {
+	var out bytes.Buffer
+	err := serveCGI(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/plain")
+		w.Header().Set("X-Thing", "1")
+		w.WriteHeader(404)
+		io.WriteString(w, "nope")
+	}), cgiRequest(t), strings.NewReader(""), &out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := "Status: 404 Not Found\r\nContent-Type: text/plain\r\nX-Thing: 1\r\n\r\nnope"; out.String() != want {
+		t.Fatalf("got %q\nwant %q", out.String(), want)
+	}
+}
+
+func TestCGIReplyWithoutAWriteStillCarriesAStatus(t *testing.T) {
+	var out bytes.Buffer
+	if err := serveCGI(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}), cgiRequest(t), strings.NewReader(""), &out); err != nil {
+		t.Fatal(err)
+	}
+	if !strings.HasPrefix(out.String(), "Status: 200 OK\r\n") || !strings.HasSuffix(out.String(), "\r\n\r\n") {
+		t.Fatalf("got %q", out.String())
+	}
+}
+
+func TestCGIReplySniffsAMissingContentType(t *testing.T) {
+	var out bytes.Buffer
+	serveCGI(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { io.WriteString(w, "<html></html>") }), cgiRequest(t), strings.NewReader(""), &out)
+	if !strings.Contains(out.String(), "Content-Type: text/html; charset=utf-8\r\n") {
+		t.Fatalf("got %q", out.String())
+	}
+}
+
+// flushRecorder notes how many bytes were out when the handler was still running.
+type flushRecorder struct {
+	bytes.Buffer
+	atFlush int
+}
+
+func TestCGIFlushSendsWhatIsBufferedAtOnce(t *testing.T) {
+	var out flushRecorder
+	serveCGI(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		io.WriteString(w, "data: one\n\n")
+		w.(http.Flusher).Flush()
+		out.atFlush = out.Len()
+		io.WriteString(w, "data: two\n\n")
+	}), cgiRequest(t), strings.NewReader(""), &out)
+	if !strings.HasSuffix(out.String(), "data: one\n\ndata: two\n\n") || out.atFlush < len("data: one\n\n") {
+		t.Fatalf("flushed %d bytes before the handler ended; total %q", out.atFlush, out.String())
+	}
+}
+
+// After a hijack stdin and stdout belong to the handler. What it writes first is an HTTP/1.1 status line;
+// DSM's CGI interface wants "Status:" instead.
+func TestCGIHijackTurnsTheStatusLineIntoACGIHeaderAndPassesBytesBothWays(t *testing.T) {
+	in, inW := io.Pipe()
+	outR, out := io.Pipe()
+	done := make(chan error, 1)
+	go func() {
+		done <- serveCGI(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			conn, brw, err := w.(http.Hijacker).Hijack()
+			if err != nil {
+				t.Error(err)
+				return
+			}
+			defer conn.Close()
+			io.WriteString(brw, "HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n\r\n")
+			brw.Flush()
+			buf := make([]byte, 16)
+			n, _ := brw.Read(buf)
+			io.WriteString(conn, "got:"+string(buf[:n]))
+		}), cgiRequest(t), in, out)
+		out.Close()
+	}()
+	r := bufio.NewReader(outR)
+	for _, want := range []string{"Status: 101 Switching Protocols", "Upgrade: websocket", "Connection: Upgrade", ""} {
+		if line, _ := r.ReadString('\n'); strings.TrimRight(line, "\r\n") != want {
+			t.Fatalf("header line %q, want %q", line, want)
+		}
+	}
+	io.WriteString(inW, "ping")
+	rest, _ := io.ReadAll(r)
+	if string(rest) != "got:ping" {
+		t.Fatalf("after the header block: %q (nothing, not even a second status, may follow the handler's bytes)", rest)
+	}
+	if err := <-done; err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestCGIReplyCannotBeWrittenAfterAHijack(t *testing.T) {
+	var out bytes.Buffer
+	serveCGI(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if _, _, err := w.(http.Hijacker).Hijack(); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := w.Write([]byte("late")); err == nil {
+			t.Error("Write after Hijack succeeded")
+		}
+	}), cgiRequest(t), strings.NewReader(""), &out)
+	if out.Len() != 0 {
+		t.Fatalf("output after a bare hijack: %q", out.String())
+	}
+}
+
+// The whole chain as DSM runs it: a WebSocket upgrade enters through the CGI environment and the container's
+// bytes come back on stdout.
+func TestWebSocketThroughTheCGIEnvironment(t *testing.T) {
+	up := newUpstream(t, wsEchoHandler)
+	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
+	req := httptest.NewRequest("GET", base+"/ws", nil)
+	req.Host = "nas.example:5001"
+	req.Header.Set("Cookie", "id=abc")
+	req.Header.Set("Connection", "Upgrade")
+	req.Header.Set("Upgrade", "websocket")
+	req.Header.Set("Origin", "https://nas.example:5001")
+	in, inW := io.Pipe()
+	outR, out := io.Pipe()
+	done := make(chan error, 1)
+	go func() { done <- serveCGI(g, req, in, out); out.Close() }()
+	r := bufio.NewReader(outR)
+	if line, _ := r.ReadString('\n'); strings.TrimSpace(line) != "Status: 101 Switching Protocols" {
+		t.Fatalf("first line %q", line)
+	}
+	for line, _ := r.ReadString('\n'); strings.TrimSpace(line) != ""; line, _ = r.ReadString('\n') {
+	}
+	io.WriteString(inW, "hello")
+	got := make([]byte, len("echo:hello"))
+	if _, err := io.ReadFull(r, got); err != nil || string(got) != "echo:hello" {
+		t.Fatalf("echo = %q, %v", got, err)
+	}
+	inW.Close() // DSM closes stdin when the browser goes away
+	io.Copy(io.Discard, r)
+	if err := <-done; err != nil {
+		t.Fatal(err)
+	}
+}

package/dist/templates/_gateway/csrf.go

@@ -0,0 +1,73 @@
+package main
+
+// CSRF defence for state-changing requests. DSM issues a SynoToken only when
+// "Enhance CSRF protection" (enable_syno_token in synoinfo.conf) is on; when it
+// is off, DSM hands every session the same placeholder and validates nothing,
+// so the token alone proves nothing. The gateway therefore needs evidence that
+// the browser itself made the request from the gateway's own origin, and it
+// never stores or trusts a token value of its own.
+
+import (
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+const maxTokenLen = 256
+
+// wellFormedToken accepts any printable ASCII value of sane length. Whether the
+// value is the right one is DSM's call (authenticate.cgi gets it on every
+// request); the gateway only refuses requests that carry nothing usable.
+func wellFormedToken(token string) bool {
+	if token == "" || len(token) > maxTokenLen {
+		return false
+	}
+	for i := 0; i < len(token); i++ {
+		if token[i] < 0x20 || token[i] > 0x7e {
+			return false
+		}
+	}
+	return true
+}
+
+// sameOrigin reports whether the browser says the request came from the page's
+// own origin. Sec-Fetch-Site, when present, must say same-origin; Origin, when
+// present, must be the request's own host. At least one must be present: a
+// browser sends Origin on every cross-origin and every non-GET request, so a
+// state-changing request with neither is not from a browser that can be trusted
+// to scope it (browsers without either, such as IE 11, are refused).
+func sameOrigin(r *http.Request) bool {
+	site := r.Header.Get("Sec-Fetch-Site")
+	origin := r.Header.Get("Origin")
+	if site == "" && origin == "" {
+		return false
+	}
+	if site != "" && site != "same-origin" {
+		return false
+	}
+	return origin == "" || originMatchesHost(origin, r.Host)
+}
+
+// originMatchesHost compares an Origin header (scheme://host[:port], no path)
+// with the Host the request was addressed to. The scheme only decides which
+// port is the default, because a CGI does not reliably learn whether the
+// connection was TLS.
+func originMatchesHost(origin, host string) bool {
+	u, err := url.Parse(origin)
+	if err != nil || u.Host == "" || (u.Scheme != "http" && u.Scheme != "https") || (u.Path != "" && u.Path != "/") || u.User != nil || u.RawQuery != "" || u.Fragment != "" {
+		return false
+	}
+	return withDefaultPort(u.Host, u.Scheme) == withDefaultPort(host, u.Scheme)
+}
+
+func withDefaultPort(host, scheme string) string {
+	host = strings.ToLower(host)
+	i := strings.LastIndex(host, ":")
+	if i >= 0 && !strings.Contains(host[i:], "]") {
+		return host
+	}
+	if scheme == "https" {
+		return host + ":443"
+	}
+	return host + ":80"
+}

package/dist/templates/_gateway/csrf_test.go

@@ -0,0 +1,155 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// browserPost is what a browser sends for a same-origin fetch to the gateway
+// (httptest requests are addressed to example.com).
+func browserPost(token string) map[string]string {
+	return map[string]string{
+		"Cookie":         "id=abc",
+		"X-SYNO-TOKEN":   token,
+		"Origin":         "http://example.com",
+		"Sec-Fetch-Site": "same-origin",
+	}
+}
+
+func with(hdr map[string]string, kv ...string) map[string]string {
+	out := map[string]string{}
+	for k, v := range hdr {
+		out[k] = v
+	}
+	for i := 0; i < len(kv); i += 2 {
+		if kv[i+1] == "" {
+			delete(out, kv[i])
+		} else {
+			out[kv[i]] = kv[i+1]
+		}
+	}
+	return out
+}
+
+func csrfGateway(t *testing.T) (http.Handler, *upstream) {
+	t.Helper()
+	up := newUpstream(t, hello)
+	return newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up), up
+}
+
+func TestSameOriginStateChangeReachesContainer(t *testing.T) {
+	g, up := csrfGateway(t)
+	cases := map[string]map[string]string{
+		"origin and fetch metadata":                           browserPost("tok"),
+		"origin only (no fetch metadata, e.g. Safari < 16.4)": with(browserPost("tok"), "Sec-Fetch-Site", ""),
+		"fetch metadata only":                                 with(browserPost("tok"), "Origin", ""),
+		"host case and default port":                          with(browserPost("tok"), "Origin", "http://EXAMPLE.com:80"),
+	}
+	for name, hdr := range cases {
+		if w := do(g, "POST", base+"/save", hdr, "x"); w.Code != 200 {
+			t.Errorf("%s: %d %q", name, w.Code, w.Body.String())
+		}
+	}
+	if up.hits.Load() != int32(len(cases)) {
+		t.Fatalf("hits=%d", up.hits.Load())
+	}
+}
+
+func TestCrossSiteStateChangeIsRefusedBeforeTheContainer(t *testing.T) {
+	g, up := csrfGateway(t)
+	cases := map[string]map[string]string{
+		"foreign origin":                with(browserPost("tok"), "Origin", "https://evil.example", "Sec-Fetch-Site", ""),
+		"foreign origin, claims same":   with(browserPost("tok"), "Origin", "https://evil.example"),
+		"origin null":                   with(browserPost("tok"), "Origin", "null", "Sec-Fetch-Site", ""),
+		"origin is not a URL":           with(browserPost("tok"), "Origin", "::::", "Sec-Fetch-Site", ""),
+		"origin has a path":             with(browserPost("tok"), "Origin", "http://example.com/x", "Sec-Fetch-Site", ""),
+		"same host other port":          with(browserPost("tok"), "Origin", "http://example.com:5001", "Sec-Fetch-Site", ""),
+		"sub-domain of the host":        with(browserPost("tok"), "Origin", "http://evil.example.com", "Sec-Fetch-Site", ""),
+		"fetch metadata cross-site":     with(browserPost("tok"), "Sec-Fetch-Site", "cross-site"),
+		"fetch metadata same-site":      with(browserPost("tok"), "Sec-Fetch-Site", "same-site"),
+		"fetch metadata none":           with(browserPost("tok"), "Sec-Fetch-Site", "none"),
+		"fetch metadata unknown":        with(browserPost("tok"), "Sec-Fetch-Site", "whatever"),
+		"fetch cross-site, origin same": with(browserPost("tok"), "Sec-Fetch-Site", "cross-site", "Origin", "http://example.com"),
+	}
+	for name, hdr := range cases {
+		w := do(g, "POST", base+"/save", hdr, "x")
+		if !refusedAsForbidden(w, "cross_site_blocked") {
+			t.Errorf("%s: %d %q", name, w.Code, w.Body.String())
+		}
+	}
+	if up.hits.Load() != 0 {
+		t.Fatalf("hits=%d", up.hits.Load())
+	}
+}
+
+func TestStateChangeWithoutAnyOriginEvidenceIsRefused(t *testing.T) {
+	g, up := csrfGateway(t)
+	hdr := with(browserPost("tok"), "Origin", "", "Sec-Fetch-Site", "")
+	w := do(g, "POST", base+"/save", hdr, "x")
+	if !refusedAsForbidden(w, "cross_site_blocked") || up.hits.Load() != 0 {
+		t.Fatalf("%d %q hits=%d", w.Code, w.Body.String(), up.hits.Load())
+	}
+}
+
+func TestStateChangeNeedsAWellFormedToken(t *testing.T) {
+	g, up := csrfGateway(t)
+	for name, token := range map[string]string{
+		"missing":       "",
+		"too long":      strings.Repeat("a", 257),
+		"control bytes": "to\x01ken",
+		"non ASCII":     "tök",
+	} {
+		hdr := with(browserPost("tok"), "X-SYNO-TOKEN", "")
+		if token != "" {
+			hdr["X-SYNO-TOKEN"] = token
+		}
+		w := do(g, "POST", base+"/save", hdr, "x")
+		if !refusedAsForbidden(w, "token_required") {
+			t.Errorf("%s: %d %q", name, w.Code, w.Body.String())
+		}
+	}
+	if up.hits.Load() != 0 {
+		t.Fatalf("hits=%d", up.hits.Load())
+	}
+}
+
+func TestSafeRequestsIgnoreOriginEvidence(t *testing.T) {
+	g, _ := csrfGateway(t)
+	hdr := map[string]string{"Cookie": "id=abc", "Origin": "https://evil.example", "Sec-Fetch-Site": "cross-site"}
+	for _, method := range []string{"GET", "HEAD"} {
+		if w := do(g, method, base+"/", hdr, ""); w.Code != 200 {
+			t.Errorf("%s: %d", method, w.Code)
+		}
+	}
+}
+
+func TestOriginMatchIgnoresDefaultPortsOnly(t *testing.T) {
+	cases := []struct {
+		origin, host string
+		want         bool
+	}{
+		{"http://nas.local:5000", "nas.local:5000", true},
+		{"https://nas.local:5001", "nas.local:5001", true},
+		{"https://nas.local", "nas.local:443", true},
+		{"http://nas.local", "nas.local", true},
+		{"https://nas.local:5001", "nas.local:5000", false},
+		{"http://[::1]:5000", "[::1]:5000", true},
+		{"http://nas.local", "nas.local:5000", false},
+		{"", "nas.local", false},
+	}
+	for _, c := range cases {
+		if got := originMatchesHost(c.origin, c.host); got != c.want {
+			t.Errorf("originMatchesHost(%q, %q) = %v", c.origin, c.host, got)
+		}
+	}
+}
+
+// refusedAsForbidden: the gateway means 403, but DSM would replace a 403 body, so it sends 401
+// with the intended status and the reason in headers.
+func refusedAsForbidden(w *httptest.ResponseRecorder, code string) bool {
+	h := w.Header()
+	return w.Code == http.StatusUnauthorized && h.Get("X-Synopkgland-Status") == "403" &&
+		h.Get("X-Synopkgland-Error") == code && strings.Contains(w.Body.String(), code)
+}

package/dist/templates/_gateway/directory.go

@@ -0,0 +1,108 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os/exec"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+const maxDirectoryOutput = 64 << 10
+const maxDirectoryGroups = 256
+
+// DSM's dynamic /usr/bin/id uses libc NSS; os/user in the static CGI does not.
+// A fixed executable, a single validated username argument and a clean locale
+// environment keep the browser's credentials and process environment out of NSS.
+// No SDK cache: query once per authenticated request, with a two-second limit.
+type directoryLookup struct {
+	timeout time.Duration
+	run     func(context.Context, string, []string, []string) ([]byte, error)
+}
+
+func (d directoryLookup) groups(ctx context.Context, user string) ([]string, error) {
+	if !userName.MatchString(user) || strings.HasPrefix(user, "-") {
+		return nil, errors.New("invalid directory account")
+	}
+	ctx, cancel := context.WithTimeout(ctx, d.timeout)
+	defer cancel()
+	out, err := d.run(ctx, "/usr/bin/id", []string{user}, []string{"LC_ALL=C"})
+	if ctx.Err() != nil {
+		return nil, fmt.Errorf("directory groups: %w", ctx.Err())
+	}
+	if err != nil {
+		return nil, errors.New("directory group lookup failed")
+	}
+	return parseDirectoryGroups(out)
+}
+
+// Bounded stdout also bounds memory if a directory returns an excessive list.
+// Never include command output in errors: it is not a diagnostic credential path.
+type directoryOutput struct{ data []byte }
+
+func (b *directoryOutput) Write(p []byte) (int, error) {
+	if len(p) > maxDirectoryOutput-len(b.data) {
+		return 0, errors.New("directory output exceeds limit")
+	}
+	b.data = append(b.data, p...)
+	return len(p), nil
+}
+func runDirectoryCommand(ctx context.Context, path string, args, env []string) ([]byte, error) {
+	cmd := exec.CommandContext(ctx, path, args...)
+	cmd.Env = env
+	cmd.WaitDelay = 100 * time.Millisecond
+	var out directoryOutput
+	cmd.Stdout = &out
+	err := cmd.Run()
+	return out.data, err
+}
+
+var directoryIDLine = regexp.MustCompile(`^uid=([0-9]+)\(([^()\r\n]+)\) gid=([0-9]+)\(([^()\r\n]+)\) groups=([^\r\n]+)\n?$`)
+var directoryGroupEntry = regexp.MustCompile(`^([0-9]+)\(([^()\r\n]+)\)$`)
+
+// Parse full id output, not id -Gn: the latter loses boundaries when AD group
+// names contain spaces (for example VT-NAS\Domain Users). Require every gid to
+// resolve to a bounded valid name, and require the primary group in the list.
+// Unresolved numeric gids, partial/malformed output and ambiguous delimiters deny.
+func parseDirectoryGroups(out []byte) ([]string, error) {
+	invalid := errors.New("incomplete or invalid directory groups")
+	if len(out) > maxDirectoryOutput {
+		return nil, invalid
+	}
+	m := directoryIDLine.FindStringSubmatch(string(out))
+	if m == nil || !validDirectoryID(m[1]) || !validDirectoryID(m[3]) || !userName.MatchString(m[2]) || !groupName.MatchString(m[4]) {
+		return nil, invalid
+	}
+	entries := strings.Split(m[5], ",")
+	if len(entries) > maxDirectoryGroups {
+		return nil, invalid
+	}
+	groups := make([]string, 0, len(entries))
+	seen := map[string]bool{}
+	primary := false
+	for _, entry := range entries {
+		g := directoryGroupEntry.FindStringSubmatch(entry)
+		if g == nil || !validDirectoryID(g[1]) || !groupName.MatchString(g[2]) || seen[g[1]] {
+			return nil, invalid
+		}
+		seen[g[1]] = true
+		if g[1] == m[3] {
+			if g[2] != m[4] {
+				return nil, invalid
+			}
+			primary = true
+		}
+		groups = append(groups, g[2])
+	}
+	if !primary {
+		return nil, invalid
+	}
+	return groups, nil
+}
+func validDirectoryID(value string) bool {
+	n, err := strconv.ParseUint(value, 10, 32)
+	return err == nil && n < 1<<32-1 && strconv.FormatUint(n, 10) == value
+}