You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2026/07/07 09:45:17 UTC
(cxf) branch coheigea/ldap created (now 7d9d0fb33b1)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a change to branch coheigea/ldap
in repository https://gitbox.apache.org/repos/asf/cxf.git
at 7d9d0fb33b1 Encode LDAP query parameter names as well
This branch includes the following new commits:
new 7d9d0fb33b1 Encode LDAP query parameter names as well
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(cxf) 01/01: Encode LDAP query parameter names as well
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch coheigea/ldap
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 7d9d0fb33b1ccd56fd1a2d7be1c3c3512594517a
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Tue Jul 7 10:44:50 2026 +0100
Encode LDAP query parameter names as well
---
.../jaxrs/ext/search/ldap/LdapQueryVisitor.java | 3 ++-
.../ext/search/ldap/LdapQueryVisitorTest.java | 30 ++++++++++++++++++++++
2 files changed, 32 insertions(+), 1 deletion(-)
diff --git a/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java b/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java
index 35dc2f49008..230b0798651 100644
--- a/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java
+++ b/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java
@@ -60,8 +60,9 @@ public class LdapQueryVisitor<T> extends AbstractUntypedSearchConditionVisitor<T
}
String ldapOperator = conditionTypeToLdapOperator(sc.getConditionType());
+ String encodedName = Util.doRFC2254Encoding(name);
String encodedRValStr = encodeQueryValues ? Util.doRFC2254Encoding(rvalStr) : rvalStr;
- sb.append(name).append(ldapOperator).append(encodedRValStr);
+ sb.append(encodedName).append(ldapOperator).append(encodedRValStr);
sb.append(')');
}
diff --git a/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java b/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java
index dc3481ffadd..075c170d873 100644
--- a/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java
+++ b/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java
@@ -20,8 +20,11 @@ package org.apache.cxf.jaxrs.ext.search.ldap;
import java.util.Date;
+import org.apache.cxf.jaxrs.ext.search.ConditionType;
+import org.apache.cxf.jaxrs.ext.search.SearchBean;
import org.apache.cxf.jaxrs.ext.search.SearchCondition;
import org.apache.cxf.jaxrs.ext.search.SearchParseException;
+import org.apache.cxf.jaxrs.ext.search.SimpleSearchCondition;
import org.apache.cxf.jaxrs.ext.search.fiql.FiqlParser;
import org.junit.Ignore;
@@ -86,6 +89,33 @@ public class LdapQueryVisitorTest {
assertEquals("(&(|(name=test)(level=18))(|(name=test1)(!level=19)))", ldap);
}
+ @Test
+ public void testLdapFilterInjectionViaUnencodedPropertyName() throws SearchParseException {
+ SearchBean bean = new SearchBean();
+ bean.set("cn)(|(sn", "admin");
+
+ SearchCondition<SearchBean> filter =
+ new SimpleSearchCondition<>(ConditionType.EQUALS, bean);
+ LdapQueryVisitor<SearchBean> visitor = new LdapQueryVisitor<>();
+ filter.accept(visitor.visitor());
+
+ assertEquals("(cn\\29\\28|\\28sn=admin)", visitor.getQuery());
+ }
+
+ @Test
+ public void testLdapFilterInjectionViaUnencodedPropertyNameWithRawValue() throws SearchParseException {
+ SearchBean bean = new SearchBean();
+ bean.set("cn)(|(sn", "admin*");
+
+ SearchCondition<SearchBean> filter =
+ new SimpleSearchCondition<>(ConditionType.EQUALS, bean);
+ LdapQueryVisitor<SearchBean> visitor = new LdapQueryVisitor<>();
+ visitor.setEncodeQueryValues(false);
+ filter.accept(visitor.visitor());
+
+ assertEquals("(cn\\29\\28|\\28sn=admin*)", visitor.getQuery());
+ }
+
@Ignore
public static class Condition {