(cxf) branch main updated: Encode LDAP query parameter names as well (#3288)

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/main by this push:
     new c2c5619b065 Encode LDAP query parameter names as well (#3288)
c2c5619b065 is described below

commit c2c5619b06586023cd212fbdf967a13c80b6036b
Author: Colm O hEigeartaigh <cohei...@users.noreply.github.com>
AuthorDate: Tue Jul 7 17:10:30 2026 +0100

    Encode LDAP query parameter names as well (#3288)
---
 .../cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java       |  3 ++-
 .../cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java   | 15 +++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git 
a/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java
 
b/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java
index 35dc2f49008..73742097edc 100644
--- 
a/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java
+++ 
b/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java
@@ -60,8 +60,9 @@ public class LdapQueryVisitor<T> extends 
AbstractUntypedSearchConditionVisitor<T
                 }
 
                 String ldapOperator = 
conditionTypeToLdapOperator(sc.getConditionType());
+                String encodedName = encodeQueryValues ? 
Util.doRFC2254Encoding(name) : name;
                 String encodedRValStr = encodeQueryValues ? 
Util.doRFC2254Encoding(rvalStr) : rvalStr;
-                sb.append(name).append(ldapOperator).append(encodedRValStr);
+                
sb.append(encodedName).append(ldapOperator).append(encodedRValStr);
 
                 sb.append(')');
             }
diff --git 
a/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java
 
b/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java
index dc3481ffadd..2db56d7c7a7 100644
--- 
a/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java
+++ 
b/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java
@@ -20,8 +20,11 @@ package org.apache.cxf.jaxrs.ext.search.ldap;
 
 import java.util.Date;
 
+import org.apache.cxf.jaxrs.ext.search.ConditionType;
+import org.apache.cxf.jaxrs.ext.search.SearchBean;
 import org.apache.cxf.jaxrs.ext.search.SearchCondition;
 import org.apache.cxf.jaxrs.ext.search.SearchParseException;
+import org.apache.cxf.jaxrs.ext.search.SimpleSearchCondition;
 import org.apache.cxf.jaxrs.ext.search.fiql.FiqlParser;
 
 import org.junit.Ignore;
@@ -86,6 +89,18 @@ public class LdapQueryVisitorTest {
         assertEquals("(&(|(name=test)(level=18))(|(name=test1)(!level=19)))", 
ldap);
     }
 
+    @Test
+    public void testLdapFilterInjectionViaUnencodedPropertyName() throws 
SearchParseException {
+        SearchBean bean = new SearchBean();
+        bean.set("cn)(|(sn", "admin");
+
+        SearchCondition<SearchBean> filter =
+            new SimpleSearchCondition<>(ConditionType.EQUALS, bean);
+        LdapQueryVisitor<SearchBean> visitor = new LdapQueryVisitor<>();
+        filter.accept(visitor.visitor());
+
+        assertEquals("(cn\\29\\28|\\28sn=admin)", visitor.getQuery());
+    }
 
     @Ignore
     public static class Condition {