NotificationsYou must be signed in to change notification settings
Fork9.7k
Star30.8k

[Ldap] Incorrect determination of RelativeDistinguishedName for the "move" operation#39518

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

jderusse merged 1 commit intosymfony:4.4fromastepin:issue_ldap_rdn

Dec 17, 2020

Merged

[Ldap] Incorrect determination of RelativeDistinguishedName for the "move" operation#39518

jderusse merged 1 commit intosymfony:4.4fromastepin:issue_ldap_rdn

Dec 17, 2020

Conversation

Copy link

Contributor

astepin commentedDec 15, 2020•
edited
Loading

Q	A
Branch?	4.4
Bug fix?	yes
New feature?	no
Deprecations?	no
Tickets	-
License	MIT
Doc PR	-

If the specified "DistinguishedName" contains a comma in the first value, the first "RelativeDistinguishedName" was determined incorrectly.
The regular expression now matches up to the first comma which was not escaped with backslash.

Testing private methods is a bit messy here. However, I thought it was better than testing this against an LDAP server.

Source:https://tools.ietf.org/html/rfc4514#section-3

carsonbot added Status: Needs Review Ldap Bug labels

Dec 15, 2020

Copy link

carsonbot commentedDec 15, 2020

Hey!

I see that this is your first PR. That is great! Welcome!

Symfony has acontribution guide which I suggest you to read.

In short:

Always add tests
Keep backward compatibility (seehttps://symfony.com/bc).
Bug fixes must be submitted against the lowest maintained branch where they apply (seehttps://symfony.com/releases)
Features and deprecations must be submitted against the 5.x branch.

Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change.

When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor!
If this PR is merged in a lower version branch, it will be merged up to all maintained branches within a few days.

I am going to sit back now and wait for the reviews.

Cheers!

Carsonbot

OskarStark requested changes

Dec 16, 2020

View reviewed changes

Copy link

Contributor

OskarStark left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

First of all, thanks for your contribution 👍 Well done for your first time here 🎉

As this is a bugfix it should target the lowest maintained branch which contains this bug, so4.4?

src/Symfony/Component/Ldap/Tests/Adapter/ExtLdap/EntryManagerTest.php OutdatedShow resolvedHide resolved

carsonbot added Status: Needs Work and removed Status: Needs Review labels

Dec 16, 2020

astepin changed the base branch from5.x to4.4

December 16, 2020 10:06

astepin requested review fromchalasr,dunglas,jderusse,lyrixx,sroze,wouterj,xabbuh andyceruto ascode owners

December 16, 2020 10:06

carsonbot added Status: Needs Review and removed Status: Needs Work labels

Dec 16, 2020

astepin force-pushed theissue_ldap_rdn branch frome9daeba to83c0abeCompare

December 16, 2020 10:10

OskarStark reviewed

Dec 16, 2020

View reviewed changes

src/Symfony/Component/Ldap/Tests/Adapter/ExtLdap/EntryManagerTest.phpShow resolvedHide resolved

OskarStark reviewed

Dec 16, 2020

View reviewed changes

src/Symfony/Component/Ldap/Tests/Adapter/ExtLdap/EntryManagerTest.php OutdatedShow resolvedHide resolved

nicolas-grekas reviewed

Dec 17, 2020

View reviewed changes

src/Symfony/Component/Ldap/Tests/Adapter/ExtLdap/EntryManagerTest.php OutdatedShow resolvedHide resolved

nicolas-grekas reviewed

Dec 17, 2020

View reviewed changes

src/Symfony/Component/Ldap/Tests/Adapter/ExtLdap/EntryManagerTest.php

		{
		return [
		['CN=Simple,DC=example,DC=net','CN=Simple'],
		['CN=James \"Jim\" Smith\, III,DC=example,DC=net','CN=James \"Jim\" Smith\, III'],

Copy link

Member

nicolas-grekasDec 17, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Sorry if it's a dumb question: should the expected value be'CN=James "Jim" Smith, III'?

Copy link

ContributorAuthor

astepinDec 17, 2020•
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Certain characters in the canonical name must be escaped for them to work with LDAP server.

So to continue working with the LDAP server we need the backslash in front of the quotes. => CN=James \"Jim\" Smith\, III

nicolas-grekas reviewed

Dec 17, 2020

View reviewed changes

src/Symfony/Component/Ldap/Adapter/ExtLdap/EntryManager.php

		privatefunctionparseRdnFromEntry(Entry$entry):string
		{
		if (!preg_match('/^([^,]+),/',$entry->getDn(),$matches)) {
		if (!preg_match('/(^[^,\\\\](?:\\\\.[^,\\\\])*),/',$entry->getDn(),$matches)) {

Copy link

Member

nicolas-grekasDec 17, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

the regexp won't work when several\ are used, eg with\\\\ or\\\\\,,isn't it?

Copy link

ContributorAuthor

astepinDec 17, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

The number of\ shouldn't matter. Compared to the old code, basically the same is done, except that now the comma is not matched if it is escaped with a\.

It's a bit tricky with the "not matching regex groups" (starting with ?: ). It is quite hard to read and understand.