hanicz opened a new pull request, #1348: URL: https://github.com/apache/knox/pull/1348
…t username without RFC-4515 escaping [KNOX-3417](https://issues.apache.org/jira/browse/KNOX-3417) - A short description of the change ## What changes were proposed in this pull request? In search-then-bind LDAP mode, Knox dropped the login username straight into an LDAP search filter with no escaping. Typing username `*)(uid=admin` turned the intended filter `(&(objectclass=person)(uid=<user>))` into `(&(objectclass=person)(uid=*)(uid=admin))`. The fix (`KnoxLdapRealm.java`): - New `escapeLdapSearchFilterValue()` — RFC 4515 escaping (* ( ) \ NUL → \2a \28 \29 \5c \00). - New `expandTemplate(..., escapeForLdapFilter)` overload (escapes the value + Matcher.quoteReplacement), switched on at the two filter sites. - Now `*)(uid=admin` becomes inert literal `uid=\2a\29\28uid=admin `— no longer alters the query. New unit tests ## How was this patch tested? Unit tests, manually tested Log level to `DEBUG` New topology: ``` <param> <name>main.ldapRealm.userSearchBase</name> <value>ou=people,dc=hadoop,dc=apache,dc=org</value> </param> <param> <name>main.ldapRealm.userSearchAttributeName</name> <value>uid</value> </param> <param> <name>main.ldapRealm.userObjectClass</name> <value>person</value> </param> ``` **Before**: ``` curl -sivk -u '*)(uid=admin:admin-password' 'https://localhost:8443/gateway/injtest/v1/gateway-status' HTTP/1.1 200 OK DEBUG knox.gateway (KnoxLdapRealm.java:getUserDn(715)) - Searching from ou=people,dc=hadoop,dc=apache,dc=org where (&(objectclass=person)(uid=admin)) scope subtree ``` **After**: ``` curl -sivk -u '*)(uid=admin:admin-password' 'https://localhost:8443/gateway/injtest/v1/gateway-status' HTTP/1.1 401 Unauthorized DEBUG knox.gateway (KnoxLdapRealm.java:getUserDn(715)) - Searching from ou=people,dc=hadoop,dc=apache,dc=org where (&(objectclass=person)(uid=\2a\29\28uid=admin)) scope subtree ``` ## Integration Tests N/A ## UI changes N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
