From 9b022358cd9002b635fc9ca5502e4aa0a33a3fe8 Mon Sep 17 00:00:00 2001 From: Daan Hoogland Date: Mon, 9 Jan 2023 11:08:06 +0100 Subject: [PATCH] escapes for injection prtection --- .../org/apache/cloudstack/ldap/OpenLdapUserManagerImpl.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/OpenLdapUserManagerImpl.java b/plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/OpenLdapUserManagerImpl.java index 5fe27e50d4da..07d896a2c84f 100644 --- a/plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/OpenLdapUserManagerImpl.java +++ b/plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/OpenLdapUserManagerImpl.java @@ -83,7 +83,7 @@ private String generateSearchFilter(final String username, Long domainId) { usernameFilter.append("("); usernameFilter.append(_ldapConfiguration.getUsernameAttribute(domainId)); usernameFilter.append("="); - usernameFilter.append((username == null ? "*" : username)); + usernameFilter.append((username == null ? "*" : LdapUtils.escapeLDAPSearchFilter(username))); usernameFilter.append(")"); String memberOfAttribute = _ldapConfiguration.getUserMemberOfAttribute(domainId); @@ -154,7 +154,7 @@ private String generateGroupSearchFilter(final String groupName, Long domainId) groupNameFilter.append("("); groupNameFilter.append(_ldapConfiguration.getCommonNameAttribute()); groupNameFilter.append("="); - groupNameFilter.append((groupName == null ? "*" : groupName)); + groupNameFilter.append((groupName == null ? "*" : LdapUtils.escapeLDAPSearchFilter(groupName))); groupNameFilter.append(")"); final StringBuilder result = new StringBuilder(); @@ -194,7 +194,7 @@ public LdapUser getUser(final String username, final String type, final String n usernameFilter.append("("); usernameFilter.append(_ldapConfiguration.getUsernameAttribute(domainId)); usernameFilter.append("="); - usernameFilter.append((username == null ? "*" : username)); + usernameFilter.append((username == null ? "*" : LdapUtils.escapeLDAPSearchFilter(username))); usernameFilter.append(")"); final StringBuilder memberOfFilter = new StringBuilder();