You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@karaf.apache.org by "jbonofre (via GitHub)" <gi...@apache.org> on 2026/09/10 14:36:23 UTC
[PR] Escape %u/%dn/%fqdn substitutions in LDAP search filters [karaf]
jbonofre opened a new pull request, #2880:
URL: https://github.com/apache/karaf/pull/2880
## Summary
- `LDAPCache` and `LDAPBackingEngine.lookupUser` built LDAP search filters by substituting `%u`/`%dn`/`%fqdn` and only doubling backslashes, which does not escape `*`, `(`, `)`, or NUL. A username containing filter metacharacters (e.g. `*`) could widen a search filter to match an unintended directory entry instead of failing lookup, and could similarly widen role-search filters.
- `LDAPLoginModule`/`LDAPPubkeyLoginModule` masked this for their own callers by pre-escaping the username before it reached the cache, but `GSSAPILdapLoginModule` and `LDAPBackingEngine.lookupUser` did not escape at all.
- This centralizes proper RFC 4515 filter escaping (via the existing `Util.doRFC2254Encoding` helper) at the point filters are actually built in `LDAPCache`/`LDAPBackingEngine`, and removes the now-redundant pre-escaping in `LDAPLoginModule`/`LDAPPubkeyLoginModule` so escaping happens exactly once. `GSSAPILdapLoginModule` needed no change since it now goes through the fixed `LDAPCache` path.
## Test plan
- [x] Added `LdapCacheTest.testUserFilterInjectionDoesNotWidenSearch` and `testBackingEngineUserFilterInjectionDoesNotWidenSearch`, which call `LDAPCache.getUserDnAndNamespace("*")` / `LDAPBackingEngine.lookupUser("*")` and assert no match.
- [x] Verified both new tests fail against the pre-fix code (a `"*"` username matched an unrelated real user) and pass with the fix.
- [x] Full existing LDAP JAAS test suite (`LdapLoginModuleTest`, `LdapLoginModuleWithEscapesTest`, `LdapCacheTest`, `LDAPPubkeyLoginModuleTest`, `GSSAPILdapLoginModuleTest`, `LdapCaseInsensitiveDNTest`, `LdapPoolingTest`, `LdapSpecialCharsInPasswordTest`) passes, including the DN-special-character and `%fqdn` role-mapping tests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@karaf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Escape %u/%dn/%fqdn substitutions in LDAP search filters [karaf]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre merged PR #2880:
URL: https://github.com/apache/karaf/pull/2880
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@karaf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Escape %u/%dn/%fqdn substitutions in LDAP search filters [karaf]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #2880:
URL: https://github.com/apache/karaf/pull/2880#issuecomment-5621057594
## Test Results
636 files - 69 636 suites - 69 49m 39s ⏱️ - 28m 59s
950 tests + 4 901 ✅ + 4 48 💤 ± 0 0 ❌ ±0 1 🔥 ±0
2 643 runs - 195 2 512 ✅ - 181 130 💤 - 14 0 ❌ ±0 1 🔥 ±0
For more details on these errors, see [this check](https://github.com/apache/karaf/runs/102931003207).
Results for commit bb26b1af. ± Comparison against base commit b8d5faf5.
[test-results]:data:application/gzip;base64,H4sIALfKomoC/03Myw7CIBCF4VcxrF0MQ6Hgy5gypQmxF0NhZXx3B7WX5fkm87/EEMewitvFKHO9iLXEfJp9SV2Oy8yArnUsfM317jRs674WokogD3rEJ1Njdxm6OLIcXyGlJbHUp1TmGkXTqP/aoqgl7vSLSgWbnKLffW7SMk0x8xDeo/GyG2yPqkVSYK0iR9JKrym0oA04DODE+wM+su1NDwEAAA==
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@karaf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org