From 0cbca61c15b970148978b0f8a175c09d9043fc3a Mon Sep 17 00:00:00 2001 From: h44z Date: Wed, 3 Sep 2025 19:37:34 +0200 Subject: [PATCH] ensure that LDAP filter values are escaped (#512) --- internal/app/auth/auth_ldap.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/internal/app/auth/auth_ldap.go b/internal/app/auth/auth_ldap.go index 64122f2..d75c3b6 100644 --- a/internal/app/auth/auth_ldap.go +++ b/internal/app/auth/auth_ldap.go @@ -54,7 +54,7 @@ func (l LdapAuthenticator) PlaintextAuthentication(userId domain.UserIdentifier, attrs := []string{"dn"} - loginFilter := strings.Replace(l.cfg.LoginFilter, "{{login_identifier}}", string(userId), -1) + loginFilter := strings.Replace(l.cfg.LoginFilter, "{{login_identifier}}", ldap.EscapeFilter(string(userId)), -1) searchRequest := ldap.NewSearchRequest( l.cfg.BaseDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 20, false, // 20 second time limit @@ -100,7 +100,7 @@ func (l LdapAuthenticator) GetUserInfo(_ context.Context, userId domain.UserIden attrs := internal.LdapSearchAttributes(&l.cfg.FieldMap) - loginFilter := strings.Replace(l.cfg.LoginFilter, "{{login_identifier}}", string(userId), -1) + loginFilter := strings.Replace(l.cfg.LoginFilter, "{{login_identifier}}", ldap.EscapeFilter(string(userId)), -1) searchRequest := ldap.NewSearchRequest( l.cfg.BaseDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 20, false, // 20 second time limit