felixfoertsch/syncthing
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

chore(api): use ldap package escape functions (#10672)

Browse Source 
Instead of our own variants, which were mostly but not 100% identical.

---------

Signed-off-by: Jakob Borg <jakob@kastelo.net>
This commit is contained in:
Jakob Borg
2026-04-29 12:06:12 +02:00
committed by GitHub
parent 0372a79986
commit 44abd15162
2 changed files with 2 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/api/api_auth.go
+2 -23
View File
@@ -270,7 +270,7 @@ func authLDAP(username string, password string, cfg config.LDAPConfiguration) bo
defer connection.Close()
bindDN := formatOptionalPercentS(cfg.BindDN, escapeForLDAPDN(username))
bindDN := formatOptionalPercentS(cfg.BindDN, ldap.EscapeDN(username))
err = connection.Bind(bindDN, password)
if err != nil {
slog.Error("Failed to bind with LDAP server", slogutil.Error(err))
@@ -291,7 +291,7 @@ func authLDAP(username string, password string, cfg config.LDAPConfiguration) bo
// the user. If this matches precisely one user then we are good to go.
// The search filter uses the same %s interpolation as the bind DN.
searchString := formatOptionalPercentS(cfg.SearchFilter, escapeForLDAPFilter(username))
searchString := formatOptionalPercentS(cfg.SearchFilter, ldap.EscapeFilter(username))
const sizeLimit = 2 // we search for up to two users -- we only want to match one, so getting any number >1 is a failure.
const timeLimit = 60 // Search for up to a minute...
searchReq := ldap.NewSearchRequest(cfg.SearchBaseDN, ldap.ScopeWholeSubtree, ldap.DerefFindingBaseObj, sizeLimit, timeLimit, false, searchString, nil, nil)
@@ -309,27 +309,6 @@ func authLDAP(username string, password string, cfg config.LDAPConfiguration) bo
return true
}
// escapeForLDAPFilter escapes a value that will be used in a filter clause
func escapeForLDAPFilter(value string) string {
// https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx#Special_Characters
// Backslash must always be first in the list so we don't double escape them.
return escapeRunes(value, []rune{'\\', '*', '(', ')', 0})
}
// escapeForLDAPDN escapes a value that will be used in a bind DN
func escapeForLDAPDN(value string) string {
// https://social.technet.microsoft.com/wiki/contents/articles/5312.active-directory-characters-to-escape.aspx
// Backslash must always be first in the list so we don't double escape them.
return escapeRunes(value, []rune{'\\', ',', '#', '+', '<', '>', ';', '"', '=', ' ', 0})
}
func escapeRunes(value string, runes []rune) string {
for _, e := range runes {
value = strings.ReplaceAll(value, string(e), fmt.Sprintf("\\%X", e))
}
return value
}
func formatOptionalPercentS(template string, username string) string {
var replacements []any
nReps := strings.Count(template, "%s") - strings.Count(template, "%%s")