Escape user- or ldap-provided strings in ldap search filters

jupyterhub / ldapauthenticator

LDAP Authenticator Plugin for Jupyter

BSD 3-Clause "New" or "Revised" License

206 stars 178 forks source link

Escape user- or ldap-provided strings in ldap search filters #238

Closed m-erhardt closed 2 months ago

m-erhardt commented 4 months ago

Escape all user- or ldap-provided fields in ldap search queries in accordance with RFC4515 to prevent malformed LDAP filter (ldap3.core.exceptions.LDAPInvalidFilterError: malformed filter) Fixes #237

consideRatio commented 2 months ago

Nice! I've now concluded this makes sense and verified that without this I run into an error but with it I don't - thanks for a great writeup in #237 @m-erhardt!!