KNOX-3417: KnoxLdapRealm builds the LDAP search filter from the clien…

[hanicz]

…t username without RFC-4515 escaping

KNOX-3417 - A short description of the change

What changes were proposed in this pull request?

In search-then-bind LDAP mode, Knox dropped the login username straight into an LDAP search filter with no escaping. Typing username *)(uid=admin turned the intended filter (&(objectclass=person)(uid=<user>)) into (&(objectclass=person)(uid=*)(uid=admin)).

The fix (KnoxLdapRealm.java):

• New escapeLdapSearchFilterValue() — RFC 4515 escaping (* ( ) \ NUL → \2a \28 \29 \5c \00).
• New expandTemplate(..., escapeForLdapFilter) overload (escapes the value + Matcher.quoteReplacement), switched on at the two filter sites.
• Now *)(uid=admin becomes inert literal uid=\2a\29\28uid=admin — no longer alters the query.

New unit tests

How was this patch tested?

Unit tests, manually tested

Log level to DEBUG
New topology:

<param>
   <name>main.ldapRealm.userSearchBase</name>
   <value>ou=people,dc=hadoop,dc=apache,dc=org</value>
</param>
<param>
    <name>main.ldapRealm.userSearchAttributeName</name>
    <value>uid</value>
</param>
<param>
    <name>main.ldapRealm.userObjectClass</name>
    <value>person</value>
</param>

Before:

curl -sivk -u '*)(uid=admin:admin-password' 'https://localhost:8443/gateway/injtest/v1/gateway-status'

HTTP/1.1 200 OK

DEBUG knox.gateway (KnoxLdapRealm.java:getUserDn(715)) - Searching from ou=people,dc=hadoop,dc=apache,dc=org where (&(objectclass=person)(uid=admin)) scope subtree

After:

curl -sivk -u '*)(uid=admin:admin-password' 'https://localhost:8443/gateway/injtest/v1/gateway-status'

HTTP/1.1 401 Unauthorized

DEBUG knox.gateway (KnoxLdapRealm.java:getUserDn(715)) - Searching from ou=people,dc=hadoop,dc=apache,dc=org where (&(objectclass=person)(uid=\2a\29\28uid=admin)) scope subtree

<param>
    <name>main.ldapRealm.userSearchBase</name>
    <value>ou=people,dc=hadoop,dc=apache,dc=org</value>
</param>
<param>
    <name>main.ldapRealm.userSearchFilter</name>
    <value>(&amp;(objectclass=person)(uid={0}))</value>
</param>

Before:

curl -ik -u '*)(uid=admin:admin-password' 'https://localhost:8443/gateway/injtestfilter/v1/gateway-status'
HTTP/1.1 200 OK
DEBUG knox.gateway (KnoxLdapRealm.java:getUserDn(715)) - Searching from ou=people,dc=hadoop,dc=apache,dc=org where (&(objectclass=person)(uid=*)(uid=admin)) scope subtree

After:

curl -ik -u '*)(uid=admin:admin-password' 'https://localhost:8443/gateway/injtestfilter/v1/gateway-status'
HTTP/1.1 401 Unauthorized
DEBUG knox.gateway (KnoxLdapRealm.java:getUserDn(715)) - Searching from ou=people,dc=hadoop,dc=apache,dc=org where (&(objectclass=person)(uid=\2a\29\28uid=admin)) scope subtree

Integration Tests

N/A

UI changes

N/A

[github-actions]

Test Results

40 tests   40 ✅  5s ⏱️
 3 suites   0 💤
 3 files     0 ❌

Results for commit 3c1f754.