Wrong logic for negatives in Garbage (G) filter middleware

[Macmod]

When a query includes a negative clause such as (!(objectClass=msDS-GroupManagedServiceAccount)), the "Garbage" (G) filter middleware may turn it into something like:

(
    !(
        |(
            objectClass=msDS-GroupManagedServiceAccount
        )
       (bfonnkergb~=jlismfmkrj)
    )
)

Which should cancel out the garbage and evaluate to true for objects of classes other than msDS-GroupManagedServiceAccount, but it doesn't. 😋
On the other hand, "moving the negative" makes it work:

(
    |(
       (!(objectClass=msDS-GroupManagedServiceAccount))
       (bfonnkergb~=jlismfmkrj)
    )
)

I'm not sure why, but there should be a workaround. It's worth noting that negatives, when applied to "garbage" clauses, really don't cause the overall query to return "all objects", for example with the query (!(bfonnkergb~=jlismfmkrj)). It's probably some sort of UNDEFINED state, for which UNDEFINED | TRUE = TRUE, but !UNDEFINED != TRUE...

[Macmod]

Actually that's not the proper solution - even moving the negative, there's an edge case when there's a double negative. For instance, when G is applied after D in the chain:

(!(!(objectClass=*)))

becomes:

(
    !(
        (
            |(!(objectClass=*))
             (garbage)
        )
    )
)

Which evaluates to false on all objects, presumably because the same issue happens in the inner filter (it evaluates to some sort of undefined state, which is not TRUE after the outer negation).

[Macmod]

It seems that, to prevent UNDEFINED propagation through NOTs (which could cause inner TRUE results to come back as UNDEFINED and be interpreted as "no results"), the only safe way to handle this is to never apply G inside a NOT.

[Macmod]

I think we're good now. :)