From cde3888e175895f01bf8ce341c3c824a6da6dc19 Mon Sep 17 00:00:00 2001 From: jvoisin Date: Tue, 14 Apr 2026 22:35:13 +0200 Subject: [PATCH] Prevent LDAP injection in bind_user>get_object_details --- cps/services/simpleldap.py | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/cps/services/simpleldap.py b/cps/services/simpleldap.py index 3ae048b5d..fecc9c5fa 100644 --- a/cps/services/simpleldap.py +++ b/cps/services/simpleldap.py @@ -31,6 +31,16 @@ except ImportError: log = logger.create() +def _escape_ldap_filter(s): + """Escape special characters for safe use in LDAP filter strings (RFC 4515).""" + s = s.replace('\\', '\\5c') + s = s.replace('*', '\\2a') + s = s.replace('(', '\\28') + s = s.replace(')', '\\29') + s = s.replace('\x00', '\\00') + return s + + class LDAPLogger(object): @staticmethod @@ -148,9 +158,11 @@ def bind_user(username, password): :returns: True if login succeeded, False if login failed, None if server unavailable. ''' + # Escape LDAP special characters to prevent LDAP injection in search filters + safe_username = _escape_ldap_filter(username) try: - if _ldap.get_object_details(username): - result = _ldap.bind_user(username, password) + if _ldap.get_object_details(safe_username): + result = _ldap.bind_user(safe_username, password) log.debug("LDAP login '%s': %r", username, result) return result is not None, None return None, None # User not found