You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@kyuubi.apache.org by "aajisaka (via GitHub)" <gi...@apache.org> on 2026/09/22 09:23:53 UTC
[PR] [AUTH] Escape LDAP special characters in filter and DN values [kyuubi]
aajisaka opened a new pull request, #7761:
URL: https://github.com/apache/kyuubi/pull/7761
### Why are the changes needed?
Usernames are substituted into LDAP search filters and into user DN patterns when building candidate bind DNs, and group DNs resolved from the directory are substituted into the membership filter. Escape those values per RFC 4515 and RFC 4514 so the directory reads them literally, substitute placeholders literally so that `$` and `\` in a username are taken as-is, and accept distinguished names that carry no comma.
### How was this patch tested?
Added new regression tests.
### Was this patch assisted by generative AI tooling?
Assisted-by: OpenCode (GLM-5.3-Flash, MiMo-V2.6-Pro)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [PR] [AUTH] Escape LDAP special characters in filter and DN values [kyuubi]
Posted by "aajisaka (via GitHub)" <gi...@apache.org>.
aajisaka commented on PR #7761:
URL: https://github.com/apache/kyuubi/pull/7761#issuecomment-5891875164
Thank you @wangzhigang1999 for your review!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [PR] [AUTH] Escape LDAP special characters in filter and DN values [kyuubi]
Posted by "wangzhigang1999 (via GitHub)" <gi...@apache.org>.
wangzhigang1999 commented on code in PR #7761:
URL: https://github.com/apache/kyuubi/pull/7761#discussion_r4120726204
##########
kyuubi-common/src/main/scala/org/apache/kyuubi/service/authentication/ldap/LdapSearch.scala:
##########
@@ -59,7 +59,7 @@ class LdapSearch(conf: KyuubiConf, ctx: DirContext) extends DirSearch with Loggi
var allLdapNames: Array[String] = null
if (LdapUtils.isDn(user)) {
val userBaseDn: String = LdapUtils.extractBaseDn(user)
- val userRdn: String = LdapUtils.extractFirstRdn(user)
+ val userRdn: String = LdapUtils.escapeLDAPSearchFilter(LdapUtils.extractFirstRdn(user))
Review Comment:
The escaping looks right overall — I confirmed the reported bypass is fixed (the same auth test fails on base and passes here), and `replaceAll` → `replace` is a good catch.
One regression in `findUserDn`:
```scala
val userRdn: String = LdapUtils.escapeLDAPSearchFilter(LdapUtils.extractFirstRdn(user))
```
This escapes the *serialized* RDN. For a user named `Alice+Ops` the DN is `cn=Alice\+Ops,...`, where the backslash is DN syntax rather than part of the value, so this produces `(cn=Alice\5c+Ops)` and searches for a value containing a literal backslash. With a bind user configured the user can no longer be found; direct bind is unaffected. Reproduced against the embedded server:
```
AssertionError: Authentication failed for user 'cn=Alice\+Ops,ou=People,dc=example,dc=com'
```
Could we decode the RDN before escaping the value?
```scala
def firstRdnAsFilterFragment(dn: String): String =
try {
val name = new LdapName(dn)
val rdn = name.getRdn(name.size() - 1)
s"${rdn.getType}=${escapeLDAPSearchFilter(String.valueOf(rdn.getValue))}"
} catch {
case _: InvalidNameException => null
}
```
With that change the LDAP suites pass 119/119 and `FindUserDnWhenUserDnEscapesSpecialCharacters` still passes, so a client-supplied `CN=User1*` is still escaped to `(CN=User1\2a)`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [PR] [AUTH] Escape LDAP special characters in filter and DN values [kyuubi]
Posted by "aajisaka (via GitHub)" <gi...@apache.org>.
aajisaka commented on code in PR #7761:
URL: https://github.com/apache/kyuubi/pull/7761#discussion_r4124728672
##########
kyuubi-common/src/main/scala/org/apache/kyuubi/service/authentication/ldap/LdapSearch.scala:
##########
@@ -59,7 +59,7 @@ class LdapSearch(conf: KyuubiConf, ctx: DirContext) extends DirSearch with Loggi
var allLdapNames: Array[String] = null
if (LdapUtils.isDn(user)) {
val userBaseDn: String = LdapUtils.extractBaseDn(user)
- val userRdn: String = LdapUtils.extractFirstRdn(user)
+ val userRdn: String = LdapUtils.escapeLDAPSearchFilter(LdapUtils.extractFirstRdn(user))
Review Comment:
Nice catch! Fixed in https://github.com/apache/kyuubi/pull/7761/commits/9bf046ab9505734b7e9c7b05edf02a9562aa8952
Thank you @wangzhigang1999
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [PR] [AUTH] Escape LDAP special characters in filter and DN values [kyuubi]
Posted by "aajisaka (via GitHub)" <gi...@apache.org>.
aajisaka commented on PR #7761:
URL: https://github.com/apache/kyuubi/pull/7761#issuecomment-5891871321
**Merge Summary:**
- merged into master https://github.com/apache/kyuubi/commit/cebcfd7eb4a4d1651defc998c16054cd8fd4f1e4
- merged into branch-1.12 https://github.com/apache/kyuubi/commit/2e4dad014f3c1f2c44d77fe0c3234305c75f6991
*Posted by `merge_kyuubi_pr.py`*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [PR] [AUTH] Escape LDAP special characters in filter and DN values [kyuubi]
Posted by "aajisaka (via GitHub)" <gi...@apache.org>.
aajisaka closed pull request #7761: [AUTH] Escape LDAP special characters in filter and DN values
URL: https://github.com/apache/kyuubi/pull/7761
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org