(shiro) branch 3.x updated: Using Rdn.escapeValues()

[lprimak]

This is an automated email from the ASF dual-hosted git repository.

lprimak pushed a commit to branch 3.x
in repository https://gitbox.apache.org/repos/asf/shiro.git


The following commit(s) were added to refs/heads/3.x by this push:
     new 0f4bfc6f8 Using Rdn.escapeValues()
0f4bfc6f8 is described below

commit 0f4bfc6f88b18aa1e6d5216037c48d1f5910d672
Author: lprimak <le...@flowlogix.com>
AuthorDate: Thu May 28 11:57:27 2026 -0500

    Using Rdn.escapeValues()
---
 .../apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java  | 8 +++++---
 .../main/java/org/apache/shiro/realm/ldap/DefaultLdapRealm.java   | 6 ++++--
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git 
a/core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java
 
b/core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java
index 0794ae98c..34202b140 100644
--- 
a/core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java
+++ 
b/core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java
@@ -39,6 +39,7 @@ import javax.naming.directory.Attributes;
 import javax.naming.directory.SearchControls;
 import javax.naming.directory.SearchResult;
 import javax.naming.ldap.LdapContext;
+import javax.naming.ldap.Rdn;
 import java.util.Collection;
 import java.util.HashSet;
 import java.util.LinkedHashSet;
@@ -234,11 +235,12 @@ public class ActiveDirectoryRealm extends 
AbstractLdapRealm {
     }
 
     protected String getUsernameWithSuffix(String username) {
+        String sanitizedUsername = Rdn.escapeValue(username);
         if (principalSuffix != null
-                && 
!username.toLowerCase(Locale.ROOT).endsWith(principalSuffix.toLowerCase(Locale.ROOT)))
 {
-            return username + principalSuffix;
+                && 
!sanitizedUsername.toLowerCase(Locale.ROOT).endsWith(principalSuffix.toLowerCase(Locale.ROOT)))
 {
+            return sanitizedUsername + principalSuffix;
         }
-        return username;
+        return sanitizedUsername;
     }
 
 }
diff --git 
a/core/src/main/java/org/apache/shiro/realm/ldap/DefaultLdapRealm.java 
b/core/src/main/java/org/apache/shiro/realm/ldap/DefaultLdapRealm.java
index e172efdd4..8aa52873e 100644
--- a/core/src/main/java/org/apache/shiro/realm/ldap/DefaultLdapRealm.java
+++ b/core/src/main/java/org/apache/shiro/realm/ldap/DefaultLdapRealm.java
@@ -35,6 +35,7 @@ import org.slf4j.LoggerFactory;
 import javax.naming.AuthenticationNotSupportedException;
 import javax.naming.NamingException;
 import javax.naming.ldap.LdapContext;
+import javax.naming.ldap.Rdn;
 
 /**
  * An LDAP {@link org.apache.shiro.realm.Realm Realm} implementation utilizing 
Sun's/Oracle's
@@ -238,11 +239,12 @@ public class DefaultLdapRealm extends AuthorizingRealm {
 
         int prefixLength = prefix != null ? prefix.length() : 0;
         int suffixLength = suffix != null ? suffix.length() : 0;
-        StringBuilder sb = new StringBuilder(prefixLength + principal.length() 
+ suffixLength);
+        String sanitizedPrincipal = Rdn.escapeValue(principal);
+        StringBuilder sb = new StringBuilder(prefixLength + 
sanitizedPrincipal.length() + suffixLength);
         if (prefixLength > 0) {
             sb.append(prefix);
         }
-        sb.append(principal);
+        sb.append(sanitizedPrincipal);
         if (suffixLength > 0) {
             sb.append(suffix);
         }