escapes for injection prtection (#7069)

Author: DaanHoogland

plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/OpenLdapUserManagerImpl.java

@@ -83,7 +83,7 @@ private String generateSearchFilter(final String username, Long domainId) {
         usernameFilter.append("(");
         usernameFilter.append(_ldapConfiguration.getUsernameAttribute(domainId));
         usernameFilter.append("=");
-        usernameFilter.append((username == null ? "*" : username));
+        usernameFilter.append((username == null ? "*" : LdapUtils.escapeLDAPSearchFilter(username)));
         usernameFilter.append(")");
 
         String memberOfAttribute = _ldapConfiguration.getUserMemberOfAttribute(domainId);
@@ -154,7 +154,7 @@ private String generateGroupSearchFilter(final String groupName, Long domainId)
         groupNameFilter.append("(");
         groupNameFilter.append(_ldapConfiguration.getCommonNameAttribute());
         groupNameFilter.append("=");
-        groupNameFilter.append((groupName == null ? "*" : groupName));
+        groupNameFilter.append((groupName == null ? "*" : LdapUtils.escapeLDAPSearchFilter(groupName)));
         groupNameFilter.append(")");
 
         final StringBuilder result = new StringBuilder();
@@ -194,7 +194,7 @@ public LdapUser getUser(final String username, final String type, final String n
         usernameFilter.append("(");
         usernameFilter.append(_ldapConfiguration.getUsernameAttribute(domainId));
         usernameFilter.append("=");
-        usernameFilter.append((username == null ? "*" : username));
+        usernameFilter.append((username == null ? "*" : LdapUtils.escapeLDAPSearchFilter(username)));
         usernameFilter.append(")");
 
         final StringBuilder memberOfFilter = new StringBuilder();