You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2026/07/07 16:10:34 UTC
(cxf) branch main updated: Encode LDAP query parameter names as well (#3288)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/main by this push:
new c2c5619b065 Encode LDAP query parameter names as well (#3288)
c2c5619b065 is described below
commit c2c5619b06586023cd212fbdf967a13c80b6036b
Author: Colm O hEigeartaigh <co...@users.noreply.github.com>
AuthorDate: Tue Jul 7 17:10:30 2026 +0100
Encode LDAP query parameter names as well (#3288)
---
.../cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java | 3 ++-
.../cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java | 15 +++++++++++++++
2 files changed, 17 insertions(+), 1 deletion(-)
diff --git a/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java b/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java
index 35dc2f49008..73742097edc 100644
--- a/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java
+++ b/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java
@@ -60,8 +60,9 @@ public class LdapQueryVisitor<T> extends AbstractUntypedSearchConditionVisitor<T
}
String ldapOperator = conditionTypeToLdapOperator(sc.getConditionType());
+ String encodedName = encodeQueryValues ? Util.doRFC2254Encoding(name) : name;
String encodedRValStr = encodeQueryValues ? Util.doRFC2254Encoding(rvalStr) : rvalStr;
- sb.append(name).append(ldapOperator).append(encodedRValStr);
+ sb.append(encodedName).append(ldapOperator).append(encodedRValStr);
sb.append(')');
}
diff --git a/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java b/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java
index dc3481ffadd..2db56d7c7a7 100644
--- a/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java
+++ b/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java
@@ -20,8 +20,11 @@ package org.apache.cxf.jaxrs.ext.search.ldap;
import java.util.Date;
+import org.apache.cxf.jaxrs.ext.search.ConditionType;
+import org.apache.cxf.jaxrs.ext.search.SearchBean;
import org.apache.cxf.jaxrs.ext.search.SearchCondition;
import org.apache.cxf.jaxrs.ext.search.SearchParseException;
+import org.apache.cxf.jaxrs.ext.search.SimpleSearchCondition;
import org.apache.cxf.jaxrs.ext.search.fiql.FiqlParser;
import org.junit.Ignore;
@@ -86,6 +89,18 @@ public class LdapQueryVisitorTest {
assertEquals("(&(|(name=test)(level=18))(|(name=test1)(!level=19)))", ldap);
}
+ @Test
+ public void testLdapFilterInjectionViaUnencodedPropertyName() throws SearchParseException {
+ SearchBean bean = new SearchBean();
+ bean.set("cn)(|(sn", "admin");
+
+ SearchCondition<SearchBean> filter =
+ new SimpleSearchCondition<>(ConditionType.EQUALS, bean);
+ LdapQueryVisitor<SearchBean> visitor = new LdapQueryVisitor<>();
+ filter.accept(visitor.visitor());
+
+ assertEquals("(cn\\29\\28|\\28sn=admin)", visitor.getQuery());
+ }
@Ignore
public static class Condition {