Expand tests and fix escaping issue in userRoleAttribute filter

apache · Apr 13, 2021 · e500674 · e500674
1 parent 91ecdc6
commit e500674
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 5 deletions.
diff --git a/java/org/apache/catalina/realm/JNDIRealm.java b/java/org/apache/catalina/realm/JNDIRealm.java
@@ -1883,11 +1883,13 @@ protected List<String> getRoles(JNDIConnection connection, User user) throws Nam
             return list;
         }
 
-        // Set up parameters for an appropriate search
+        // Set up parameters for an appropriate search filter
+        // The dn is already attribute value escaped but the others are not
+        // This is a filter so all input will require filter escaping
         String filter = connection.roleFormat.format(new String[] {
                 doFilterEscaping(dn),
                 doFilterEscaping(doAttributeValueEscaping(username)),
-                userRoleId });
+                doFilterEscaping(doAttributeValueEscaping(userRoleId)) });
         SearchControls controls = new SearchControls();
         if (roleSubtree) {
             controls.setSearchScope(SearchControls.SUBTREE_SCOPE);

diff --git a/test/org/apache/catalina/realm/TestJNDIRealmIntegration.java b/test/org/apache/catalina/realm/TestJNDIRealmIntegration.java
@@ -48,13 +48,14 @@ public class TestJNDIRealmIntegration {
     private static final String USER_BASE = "ou=people,dc=example,dc=com";
     private static final String ROLE_SEARCH_A = "member={0}";
     private static final String ROLE_SEARCH_B = "member=cn={1},ou=people,dc=example,dc=com";
+    private static final String ROLE_SEARCH_C = "member=cn={2},ou=people,dc=example,dc=com";
 
     private static InMemoryDirectoryServer ldapServer;
 
     @Parameterized.Parameters(name = "{index}: user[{3}], pwd[{4}]")
     public static Collection<Object[]> parameters() {
         List<Object[]> parameterSets = new ArrayList<>();
-        for (String roleSearch : new String[] { ROLE_SEARCH_A, ROLE_SEARCH_B }) {
+        for (String roleSearch : new String[] { ROLE_SEARCH_A, ROLE_SEARCH_B, ROLE_SEARCH_C }) {
             addUsers(USER_PATTERN, null, null, roleSearch, parameterSets);
             addUsers(null, USER_SEARCH, USER_BASE, roleSearch, parameterSets);
         }
@@ -128,6 +129,7 @@ public static void createLDAP() throws Exception {
 
         try (LDAPConnection conn =  ldapServer.getConnection()) {
 
+            // Note: Only the DNs need attribute value escaping
             AddRequest addBase = new AddRequest(
                     "dn: dc=example,dc=com",
                     "objectClass: top",
@@ -159,7 +161,7 @@ public static void createLDAP() throws Exception {
                     "objectClass: top",
                     "objectClass: person",
                     "objectClass: organizationalPerson",
-                    "cn: t\\;",
+                    "cn: t;",
                     "sn: Tsemicolon",
                     "userPassword: test");
             result = conn.processOperation(addUserTestSemicolon);
@@ -170,7 +172,7 @@ public static void createLDAP() throws Exception {
                     "objectClass: top",
                     "objectClass: person",
                     "objectClass: organizationalPerson",
-                    "cn: t\\*",
+                    "cn: t*",
                     "sn: Tasterisk",
                     "userPassword: test");
             result = conn.processOperation(addUserTestAsterisk);