This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch 3.6.x-fixes in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 867804a2f73ba326fce7dfff83f38a894b6e079c Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Tue Jul 7 17:10:30 2026 +0100 Encode LDAP query parameter names as well (#3288) (cherry picked from commit c2c5619b06586023cd212fbdf967a13c80b6036b) --- .../cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java | 3 ++- .../cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java | 15 +++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java b/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java index 35dc2f49008..73742097edc 100644 --- a/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java +++ b/rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java @@ -60,8 +60,9 @@ public class LdapQueryVisitor<T> extends AbstractUntypedSearchConditionVisitor<T } String ldapOperator = conditionTypeToLdapOperator(sc.getConditionType()); + String encodedName = encodeQueryValues ? Util.doRFC2254Encoding(name) : name; String encodedRValStr = encodeQueryValues ? Util.doRFC2254Encoding(rvalStr) : rvalStr; - sb.append(name).append(ldapOperator).append(encodedRValStr); + sb.append(encodedName).append(ldapOperator).append(encodedRValStr); sb.append(')'); } diff --git a/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java b/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java index dc3481ffadd..2db56d7c7a7 100644 --- a/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java +++ b/rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java @@ -20,8 +20,11 @@ package org.apache.cxf.jaxrs.ext.search.ldap; import java.util.Date; +import org.apache.cxf.jaxrs.ext.search.ConditionType; +import org.apache.cxf.jaxrs.ext.search.SearchBean; import org.apache.cxf.jaxrs.ext.search.SearchCondition; import org.apache.cxf.jaxrs.ext.search.SearchParseException; +import org.apache.cxf.jaxrs.ext.search.SimpleSearchCondition; import org.apache.cxf.jaxrs.ext.search.fiql.FiqlParser; import org.junit.Ignore; @@ -86,6 +89,18 @@ public class LdapQueryVisitorTest { assertEquals("(&(|(name=test)(level=18))(|(name=test1)(!level=19)))", ldap); } + @Test + public void testLdapFilterInjectionViaUnencodedPropertyName() throws SearchParseException { + SearchBean bean = new SearchBean(); + bean.set("cn)(|(sn", "admin"); + + SearchCondition<SearchBean> filter = + new SimpleSearchCondition<>(ConditionType.EQUALS, bean); + LdapQueryVisitor<SearchBean> visitor = new LdapQueryVisitor<>(); + filter.accept(visitor.visitor()); + + assertEquals("(cn\\29\\28|\\28sn=admin)", visitor.getQuery()); + } @Ignore public static class Condition {
