Skip to content

Commit 613bc49

Browse files
committed
Add forward slash encoding to DefaultEncoder's encodeForLDAP and encodeForDN
According to [1] and [2], the forward slash ('/') character should be encoded for LDAP filters and distinguished names [1] https://docs.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax [2] https://social.technet.microsoft.com/wiki/contents/articles/5312.active-directory-characters-to-escape.aspx
1 parent 284066b commit 613bc49

File tree

1 file changed

+12
-1
lines changed

1 file changed

+12
-1
lines changed

src/main/java/org/owasp/esapi/reference/DefaultEncoder.java

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -305,13 +305,18 @@ public String encodeForLDAP(String input, boolean encodeWildcards) {
305305
}
306306
// TODO: replace with LDAP codec
307307
StringBuilder sb = new StringBuilder();
308+
// According to "Special Characters" at [1], the encoder should escape '*', '(', ')', '\', '/', NUL. Also see [2].
309+
// [1] https://docs.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax
310+
// [2] https://social.technet.microsoft.com/wiki/contents/articles/5312.active-directory-characters-to-escape.aspx
308311
for (int i = 0; i < input.length(); i++) {
309312
char c = input.charAt(i);
310-
311313
switch (c) {
312314
case '\\':
313315
sb.append("\\5c");
314316
break;
317+
case '/':
318+
sb.append("\\2f");
319+
break;
315320
case '*':
316321
if (encodeWildcards) {
317322
sb.append("\\2a");
@@ -349,12 +354,18 @@ public String encodeForDN(String input) {
349354
if ((input.length() > 0) && ((input.charAt(0) == ' ') || (input.charAt(0) == '#'))) {
350355
sb.append('\\'); // add the leading backslash if needed
351356
}
357+
// According to [1] and [2], the encoder should escape forward slash ('/') in DNs.
358+
// [1] https://docs.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax
359+
// [2] https://social.technet.microsoft.com/wiki/contents/articles/5312.active-directory-characters-to-escape.aspx
352360
for (int i = 0; i < input.length(); i++) {
353361
char c = input.charAt(i);
354362
switch (c) {
355363
case '\\':
356364
sb.append("\\\\");
357365
break;
366+
case '/':
367+
sb.append("\\/");
368+
break;
358369
case ',':
359370
sb.append("\\,");
360371
break;

0 commit comments

Comments
 (0)