On Wed, 2 Sep 2026 12:44:06 GMT, Timofei Fedotov <[email protected]> wrote:
>> Rfc2253Parser silently accepted an empty RDN (no attributeTypeAndValue pair)
>> instead of
>> throwing InvalidNameException. Rdn.getType()/getValue() then indexed an empty
>> internal list, throwing an uncaught IndexOutOfBoundsException instead of the
>> documented
>> exception.
>>
>> Two independent entry points:
>>
>> Rdn("") - the original fuzzer-found crash.
>> LdapName("cn=x,") / LdapName.add("") - a string with a trailing , or ;,
>> which never goes
>> through Rdn(String) at all (LdapName builds the RDN directly via
>> Rfc2253Parser).
>>
>> Add one check, rdn.size() == 0, throw InvalidNameException, placed in
>>
>> Rfc2253Parser.doParse(Rdn) - the single method both paths funnel through.
>>
>> Also add a regression check that "cn=a,,cn=b" still throws as before.
>>
>>
>>
>>
>> ---------
>> - [x] I confirm that I make this contribution in accordance with the
>> [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai).
>
> Timofei Fedotov has updated the pull request incrementally with one
> additional commit since the last revision:
>
> Add regression test
src/java.naming/share/classes/javax/naming/ldap/Rdn.java line 169:
> 167: entries = new ArrayList<>(DEFAULT_SIZE);
> 168: (new Rfc2253Parser(rdnString)).parseRdn(this);
> 169: if (entries.isEmpty()) {
Hello @Sovtouch, the `Rfc2253Parser.parseRdn()` already has necessary checks
for a few other cases of invalid RDN. I think the `parseRdn(...)` should be
able to detect this additional case as well and we should throw the
`InvalidNameException` from within the `parseRdn(...)` method instead of adding
a check at call sites.
I see that the `doParse(...)` method of `Rfc2253Parser` has already been
updated in this PR to do this check there, so is there a reason why this
additional check is required here in the constructor?
src/java.naming/share/classes/javax/naming/ldap/Rfc2253Parser.java line 126:
> 124:
> 125: // RFC 2253: an RDN MUST contain at least one
> 126: // attributeTypeAndValue. If the outer loop above never ran
I think we should trim down this comment to just the first sentence and remove
the rest. So something like:
// RFC 2253 - RDN must contain at least one attributeTypeAndValue:
// RelativeDistinguishedName ::= SET SIZE (1..MAX) OF AttributeTypeAndValue
src/java.naming/share/classes/javax/naming/ldap/Rfc2253Parser.java line 135:
> 133: // InvalidNameException.
> 134: if (rdn.size() == 0) {
> 135: throw new InvalidNameException(
Please indent this to move it "inside" the `if` block.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/32648#discussion_r4024630157
PR Review Comment: https://git.openjdk.org/jdk/pull/32648#discussion_r4024654439
PR Review Comment: https://git.openjdk.org/jdk/pull/32648#discussion_r4024634126
