Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[VAULT-4018] EscapeLDAPValue - catch trailing escape character #13452

Merged
merged 2 commits into from
Dec 15, 2021
Merged

[VAULT-4018] EscapeLDAPValue - catch trailing escape character #13452

merged 2 commits into from
Dec 15, 2021

Conversation

VinnyHC
Copy link
Contributor

@VinnyHC VinnyHC commented Dec 15, 2021

Properly escape a trailing escape character.

PR addresses findings from [Trail of Bits 018]:

The EscapeLDAPValue function does not validate input strings properly because it is possible to pass an input string that leads to panic. The bug occurs when the escaping character (“\”) in the passed string does not precede any character (is located at the end of the string).

@raskchanky
Copy link
Contributor

It's worth adding a changelog for this one.

@vercel vercel bot temporarily deployed to Preview – vault-storybook December 15, 2021 20:53 Inactive
@vercel vercel bot temporarily deployed to Preview – vault December 15, 2021 20:53 Inactive
@VinnyHC VinnyHC merged commit eadbe96 into main Dec 15, 2021
@VinnyHC VinnyHC deleted the vinnyhc/Vault-4018-EscapeLDAPValue-validation branch December 15, 2021 21:17
heppu pushed a commit to heppu/vault that referenced this pull request Jan 13, 2022
@VinnyHC @heppu
EscapeLDAPValue - catch trailing escape character (hashicorp#13452)
17932a4 
* [VAULT-4018] - EscapeLDAPValue catch trailing escape character
@peaceofthepai peaceofthepai added this to the 1.10 milestone Feb 25, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@raskchanky raskchanky raskchanky approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
1.10
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@VinnyHC @raskchanky @peaceofthepai