Skip to content

fix: escape quoted-string metacharacters in digest-md5 response#595

Merged
cpuschma merged 1 commit into
go-ldap:masterfrom
netliomax25-code:digest-md5-response-escape
Jun 9, 2026
Merged

fix: escape quoted-string metacharacters in digest-md5 response#595
cpuschma merged 1 commit into
go-ldap:masterfrom
netliomax25-code:digest-md5-response-escape

Conversation

@netliomax25-code

Copy link
Copy Markdown
Contributor
  1. computeResponse writes username, realm, nonce and digest-uri straight into the quoted-string directives of the digest-response without escaping \ and ", which RFC 2831 section 7.1 requires for a quoted string.
  2. A " in the username (application supplied) or in the server-supplied realm/nonce that gets echoed back closes the directive early and injects extra directives into the SASL credential, e.g. username a",realm="x yields a second realm= in the response.
  3. Added quotedStringEscape and applied it to each quoted value. The digest is still computed over the raw values, so only the wire encoding changes and the server recovers the same values after unescaping.

Validation: added two unit tests in bind_test.go that fail on the current code (the raw quote breaks out) and pass with the escape applied.

@cpuschma cpuschma merged commit c86c2e2 into go-ldap:master Jun 9, 2026
4 checks passed
@cpuschma cpuschma added bug go Pull requests that update go code labels Jun 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants