Fix LDAP vulnerability

StevenWeathers · Nov 2, 2021 · ebcb499 · ebcb499
1 parent 1417277
commit ebcb499
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/auth.go b/auth.go
@@ -68,7 +68,7 @@ func (s *server) authAndCreateUserLdap(userUsername string, userPassword string)
 
 	searchRequest := ldap.NewSearchRequest(viper.GetString("auth.ldap.basedn"),
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		fmt.Sprintf(viper.GetString("auth.ldap.filter"), userUsername),
+		fmt.Sprintf(viper.GetString("auth.ldap.filter"), ldap.EscapeFilter(userUsername)),
 		[]string{"dn", viper.GetString("auth.ldap.mail_attr"), viper.GetString("auth.ldap.cn_attr")},
 		nil,
 	)