Skip to content

fix: escape attribute and matching rule in DecompileFilter#596

Merged
cpuschma merged 1 commit into
go-ldap:masterfrom
netliomax25-code:decompile-filter-escape-attribute
Jun 14, 2026
Merged

fix: escape attribute and matching rule in DecompileFilter#596
cpuschma merged 1 commit into
go-ldap:masterfrom
netliomax25-code:decompile-filter-escape-attribute

Conversation

@netliomax25-code

Copy link
Copy Markdown
Contributor
  1. DecompileFilter runs the assertion value through EscapeFilter, but the attribute description (equality, substrings, >=, <=, ~=, present) and the extensible-match attribute and matching rule are written to the output verbatim.
  2. A filter packet from an untrusted peer whose attribute or matching-rule bytes contain the filter metacharacters ()*\ breaks out of its component and injects extra clauses into the reconstructed string. An equality packet with attribute uid)(uid=admin decompiles to (uid)(uid=admin=x).

Ran each attribute emission and the extensible-match matching rule through EscapeFilter, the same way the value is already handled. Legitimate attribute descriptors are ASCII and contain none of the escaped characters, so existing round-trips are unchanged. Added a regression test that builds the crafted packets and checks the metacharacters come back escaped.

@cpuschma cpuschma self-assigned this Jun 14, 2026
@cpuschma cpuschma added enhancement go Pull requests that update go code labels Jun 14, 2026
@cpuschma cpuschma merged commit 9f7438e into go-ldap:master Jun 14, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants