Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

objectGUID contains "5c" makes the filter parser fails to parse #1000

Open
krizex opened this issue Nov 9, 2021 · 3 comments
Open

objectGUID contains "5c" makes the filter parser fails to parse #1000

krizex opened this issue Nov 9, 2021 · 3 comments

Comments

@krizex
Copy link
Contributor

krizex commented Nov 9, 2021

ldap3 version: 2.9.1
Python: 3.8.10

When I trying to search with filter "(objectguid=db6ffb06-5c7e-432d-a899-7eda79866582)" I got the following error:

adagent.domains.connection Operation on LDAP connection[TMP-windows-i3i4uf5.ucc.local] failed Severity=ERROR	Traceback (most recent call last):	  File "/opt/ad-service/adagent/domains/connection.py", line 120, in get_connection	    yield conn	  File "/opt/ad-service/adagent/domains/connection.py", line 134, in get_tmp_connection	    yield c	  File "/opt/ad-service/adagent/ldap/cmd.py", line 160, in _get_connection	    yield conn	  File "/opt/ad-service/adagent/ldap/cmd.py", line 165, in search_objects    await run_in_default_executor(lambda: conn.search(args.search_base, args.s_filter, attributes=['distinguishedName']))	  File "/opt/ad-service/adagent/utils/executor.py", line 19, in run_in_default_executor	    return await run_in_executor(None, func, *args)	  File "/opt/ad-service/adagent/utils/executor.py", line 15, in run_in_executor	    return await loop.run_in_executor(executor, runner)	  File "/usr/lib/python3.8/concurrent/futures/thread.py", line 57, in run	    result = self.fn(*self.args, **self.kwargs)	  File "/opt/ad-service/adagent/ldap/cmd.py", line 165, in <lambda>	    await run_in_default_executor(lambda: conn.search(args.search_base, args.s_filter, attributes=['distinguishedName']))	  File "/usr/local/lib/python3.8/dist-packages/ldap3/core/connection.py", line 838, in search	    request = search_operation(search_base,	  File "/usr/local/lib/python3.8/dist-packages/ldap3/operation/search.py", line 371, in search_operation	    request['filter'] = compile_filter(parse_filter(search_filter, schema, auto_escape, auto_encode, validator, check_names).elements[0])  # parse the searchFilter string and compile it starting from the root node	  File "/usr/local/lib/python3.8/dist-packages/ldap3/operation/search.py", line 290, in compile_filter	    matching_filter['assertionValue'] = AssertionValue(prepare_filter_for_sending(filter_node.assertion['value']))  File "/usr/local/lib/python3.8/dist-packages/ldap3/protocol/convert.py", line 215, in prepare_filter_for_sending	    return bytes(ints)	ValueError: bytes must be in range(0, 256) TransactionId=cf2bcf8b-5683-40da-a68a-cbbea6680880

It should be a regression of #762

@krizex
Copy link
Contributor Author

krizex commented Nov 9, 2021

The fix (08ff836) mentioned in #894 looks incomplete. I think we also have to remove the check https://github.com/cannatag/ldap3/blob/master/ldap3/protocol/convert.py#L201
@cannatag any insights?

Update:
The fix (08ff836) mentioned in #894 could fix the issue in the mock server but will trigger the failure in #762 again.
The function check_backslash should be paired use with prepare_filter_for_sending. However, before the fix of 08ff836, only check_backslash is called in the mock server but not prepare_filter_for_sending.

The correct fix should be:
paired call check_backslash and prepare_filter_for_sending in the mock server.

@plettich
Copy link

We have the same issue when using a search filter like (objectGUID=\\26\\17\\2d\\b9\\ea\\5c\\42\\40\\aa\\c1\\ed\\d9\\49\\c1\\1a\\bc).

@marconfus
Copy link

I can confirm, that the bug was fixed in 2.8 and 2.8.1.
But it reappeared in 2.9 (and was there in 2.7)

plettich added a commit to privacyidea/privacyidea that referenced this issue Mar 30, 2023
Also revert ldap3 back to v2.8.1 to avoid cannatag/ldap3#1000
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants