jbonofre opened a new pull request, #2881:
URL: https://github.com/apache/karaf/pull/2881
## Summary
Backport of #2880 to `karaf-4.4.x`.
- `LDAPCache` and `LDAPBackingEngine.lookupUser` built LDAP search filters
by substituting `%u`/`%dn`/`%fqdn` and only doubling backslashes, which does
not escape `*`, `(`, `)`, or NUL. A username containing filter metacharacters
(e.g. `*`) could widen a search filter to match an unintended directory entry
instead of failing lookup, and could similarly widen role-search filters.
- `LDAPLoginModule`/`LDAPPubkeyLoginModule` masked this for their own
callers by pre-escaping the username before it reached the cache, but
`GSSAPILdapLoginModule` and `LDAPBackingEngine.lookupUser` did not escape at
all.
- This centralizes proper RFC 4515 filter escaping (via the existing
`Util.doRFC2254Encoding` helper) at the point filters are actually built in
`LDAPCache`/`LDAPBackingEngine`, and removes the now-redundant pre-escaping in
`LDAPLoginModule`/`LDAPPubkeyLoginModule` so escaping happens exactly once.
`GSSAPILdapLoginModule` needed no change since it now goes through the fixed
`LDAPCache` path.
Cherry-picked cleanly from main, no conflicts.
## Test plan
- [x] Added `LdapCacheTest.testUserFilterInjectionDoesNotWidenSearch` and
`testBackingEngineUserFilterInjectionDoesNotWidenSearch`, which call
`LDAPCache.getUserDnAndNamespace("*")` / `LDAPBackingEngine.lookupUser("*")`
and assert no match.
- [x] Verified both new tests fail against the pre-fix code (a `"*"`
username matched an unrelated real user) and pass with the fix.
- [x] Full existing LDAP JAAS test suite (`LdapLoginModuleTest`,
`LdapLoginModuleWithEscapesTest`, `LdapCacheTest`, `LDAPPubkeyLoginModuleTest`,
`GSSAPILdapLoginModuleTest`, `LdapCaseInsensitiveDNTest`, `LdapPoolingTest`,
`LdapSpecialCharsInPasswordTest`) passes on `karaf-4.4.x`, including the
DN-special-character and `%fqdn` role-mapping tests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
