This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/ldap in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 7d9d0fb33b1ccd56fd1a2d7be1c3c3512594517a Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Tue Jul 7 10:44:50 2026 +0100 Encode LDAP query parameter names as well --- .../jaxrs/ext/search/ldap/LdapQueryVisitor.java | 3 ++- .../ext/search/ldap/LdapQueryVisitorTest.java | 30 ++++++++++++++++++++++ 2 files changed, 32 insertions(+), 1 deletion(-) diff --git a/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java b/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java index 35dc2f49008..230b0798651 100644 --- a/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java +++ b/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java @@ -60,8 +60,9 @@ public class LdapQueryVisitor<T> extends AbstractUntypedSearchConditionVisitor<T } String ldapOperator = conditionTypeToLdapOperator(sc.getConditionType()); + String encodedName = Util.doRFC2254Encoding(name); String encodedRValStr = encodeQueryValues ? Util.doRFC2254Encoding(rvalStr) : rvalStr; - sb.append(name).append(ldapOperator).append(encodedRValStr); + sb.append(encodedName).append(ldapOperator).append(encodedRValStr); sb.append(')'); } diff --git a/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java b/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java index dc3481ffadd..075c170d873 100644 --- a/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java +++ b/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java @@ -20,8 +20,11 @@ package org.apache.cxf.jaxrs.ext.search.ldap; import java.util.Date; +import org.apache.cxf.jaxrs.ext.search.ConditionType; +import org.apache.cxf.jaxrs.ext.search.SearchBean; import org.apache.cxf.jaxrs.ext.search.SearchCondition; import org.apache.cxf.jaxrs.ext.search.SearchParseException; +import org.apache.cxf.jaxrs.ext.search.SimpleSearchCondition; import org.apache.cxf.jaxrs.ext.search.fiql.FiqlParser; import org.junit.Ignore; @@ -86,6 +89,33 @@ public class LdapQueryVisitorTest { assertEquals("(&(|(name=test)(level=18))(|(name=test1)(!level=19)))", ldap); } + @Test + public void testLdapFilterInjectionViaUnencodedPropertyName() throws SearchParseException { + SearchBean bean = new SearchBean(); + bean.set("cn)(|(sn", "admin"); + + SearchCondition<SearchBean> filter = + new SimpleSearchCondition<>(ConditionType.EQUALS, bean); + LdapQueryVisitor<SearchBean> visitor = new LdapQueryVisitor<>(); + filter.accept(visitor.visitor()); + + assertEquals("(cn\\29\\28|\\28sn=admin)", visitor.getQuery()); + } + + @Test + public void testLdapFilterInjectionViaUnencodedPropertyNameWithRawValue() throws SearchParseException { + SearchBean bean = new SearchBean(); + bean.set("cn)(|(sn", "admin*"); + + SearchCondition<SearchBean> filter = + new SimpleSearchCondition<>(ConditionType.EQUALS, bean); + LdapQueryVisitor<SearchBean> visitor = new LdapQueryVisitor<>(); + visitor.setEncodeQueryValues(false); + filter.accept(visitor.visitor()); + + assertEquals("(cn\\29\\28|\\28sn=admin*)", visitor.getQuery()); + } + @Ignore public static class Condition {
