Fix LDAP vulnerability

StevenWeathers · Nov 2, 2021 · f1524d0 · f1524d0
1 parent 2b9ae2e
commit f1524d0
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/auth.go b/auth.go
@@ -68,7 +68,7 @@ func (s *server) authAndCreateUserLdap(UserName string, UserPassword string) (*d
 
 	searchRequest := ldap.NewSearchRequest(viper.GetString("auth.ldap.basedn"),
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		fmt.Sprintf(viper.GetString("auth.ldap.filter"), UserName),
+		fmt.Sprintf(viper.GetString("auth.ldap.filter"), ldap.EscapeFilter(UserName)),
 		[]string{"dn", viper.GetString("auth.ldap.mail_attr"), viper.GetString("auth.ldap.cn_attr")},
 		nil,
 	)