Skip to content

fix: reject empty attribute type in ParseDN - #643

Open
netliomax25-code wants to merge 1 commit into
go-ldap:masterfrom
netliomax25-code:parse-dn-empty-type
Open

netliomax25-code wants to merge 1 commit into
go-ldap:masterfrom
netliomax25-code:parse-dn-empty-type

Conversation

@netliomax25-code

Copy link
Copy Markdown
Contributor
  1. ParseDN uses len(attr.Type) == 0 to decide whether an unescaped = starts the value, but setType accepts a segment that decodes to the empty string, so the type stays empty and a later = in the same pair re-binds it.
  2. The empty leading segment is silently dropped: =cn=admin,dc=net and DC=example,=DC=net parse without error into the same structures as cn=admin,dc=net and DC=example,DC=net, and compare equal under DN.Equal. RFC 4514 section 3 defines attributeType = descr / numericoid, which is never empty, and the existing tests already expect the single-equals forms (=test,DC=example,DC=com, DC=example,=net) to fail.

Tracked type consumption with an explicit flag so a set-but-empty type falls through to the existing "incomplete type, value pair" errors. Valid DNs parse exactly as before, and the previously expected error messages are unchanged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant