(directory-ldap-api) branch master updated: Fixed the DN parsng whoch didn't end with an error when we had trailing chars

[el...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/directory-ldap-api.git


The following commit(s) were added to refs/heads/master by this push:
     new 76cb5ee0c Fixed the DN parsng whoch didn't end with an error when we had trailing chars
76cb5ee0c is described below

commit 76cb5ee0cca62d4689c87ca0817895202cc0e42d
Author: emmanuel lecharny <el...@apache.org>
AuthorDate: Fri Sep 4 05:45:17 2026 +0200

    Fixed the DN parsng whoch didn't end with an error when we had trailing
    chars
---
 .../api/ldap/model/name/ComplexDnParser.java       |  4 +-
 .../name/ComplexDnParserTrailingCharsTest.java     | 71 ++++++++++++++++++++++
 2 files changed, 73 insertions(+), 2 deletions(-)

diff --git a/ldap/model/src/main/java/org/apache/directory/api/ldap/model/name/ComplexDnParser.java b/ldap/model/src/main/java/org/apache/directory/api/ldap/model/name/ComplexDnParser.java
index af791996a..9f8b10541 100644
--- a/ldap/model/src/main/java/org/apache/directory/api/ldap/model/name/ComplexDnParser.java
+++ b/ldap/model/src/main/java/org/apache/directory/api/ldap/model/name/ComplexDnParser.java
@@ -2007,8 +2007,8 @@ import static org.apache.directory.api.util.ParserUtil.SPACE;
                     }
                     else
                     {
-                        // The end...
-                        break;
+                        throw new ParseException( I18n.err( I18n.ERR_13635_INVALID_VALUE_CHARACTER, 
+                            ( char ) bytes[pos.start] ), pos.start );
                     }
                 }
 
diff --git a/ldap/model/src/test/java/org/apache/directory/api/ldap/model/name/ComplexDnParserTrailingCharsTest.java b/ldap/model/src/test/java/org/apache/directory/api/ldap/model/name/ComplexDnParserTrailingCharsTest.java
new file mode 100644
index 000000000..5b9149a42
--- /dev/null
+++ b/ldap/model/src/test/java/org/apache/directory/api/ldap/model/name/ComplexDnParserTrailingCharsTest.java
@@ -0,0 +1,71 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ *
+ */
+package org.apache.directory.api.ldap.model.name;
+
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import org.apache.directory.api.ldap.model.exception.LdapException;
+import org.apache.directory.api.ldap.model.exception.LdapInvalidDnException;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.parallel.Execution;
+import org.junit.jupiter.api.parallel.ExecutionMode;
+
+
+/**
+ * Test that the complex DN parser consumes the whole input or fails: it must
+ * not silently discard trailing bytes after the last parsed RDN, because the
+ * Dn keeps the complete input as its user-provided name and a downstream
+ * parser may read the never-validated tail differently.
+ *
+ * @author <a href="mailto:dev@directory.apache.org">Apache Directory Project</a>
+ */
+@Execution(ExecutionMode.CONCURRENT)
+public class ComplexDnParserTrailingCharsTest
+{
+    @Test
+    public void testTrailingGarbageAfterEscapedValueIsRejected()
+    {
+        // The LDAP hex escape '\2C' routes parsing to the complex parser; the
+        // unescaped '<' ends the value early and ',uid=admin,ou=system' was
+        // previously discarded while remaining in Dn.getName()
+        assertThrows( LdapInvalidDnException.class,
+            () -> new Dn( "uid=jsmith\\2C<,uid=admin,ou=system" ) );
+    }
+
+
+    @Test
+    public void testIsValidRejectsTrailingGarbage()
+    {
+        assertFalse( Dn.isValid( "uid=jsmith\\2C<,uid=admin,ou=system" ) );
+        assertFalse( Dn.isValid( "cn=a\\2Cb>trailing" ) );
+    }
+
+
+    @Test
+    public void testValidComplexDnsStillParse() throws LdapException
+    {
+        assertTrue( Dn.isValid( "cn=a\\,b,dc=example,dc=com" ) );
+        assertTrue( Dn.isValid( "cn=a\\2Cb,dc=example,dc=com" ) );
+        assertTrue( Dn.isValid( "ou=x\\+y,dc=example,dc=com" ) );
+    }
+}
\ No newline at end of file