zeppelin
zeppelin copied to clipboard
[HOTFIX] Escape Ldap search filters
What is this PR for?
Escaping Ldap filters to mitigate un-intended behaviors
What type of PR is it?
Hot Fix
Todos
- [x] - Add filters based on https://github.com/apache/tomcat/blob/main/java/org/apache/catalina/realm/JNDIRealm.java#L2921
What is the Jira issue?
N/A
How should this be tested?
- CI should be green
Screenshots (if appropriate)
Questions:
- Does the license files need to update? No
- Is there breaking changes for older versions? No
- Does this needs documentation? No
Is there no ready-made implementation, e.g. in Java or in the Shiro project?
After you commented, I tried to find related code in javax.security
and shiro
. I, however, couldn't find a similar one.
ping @zjffdu @Reamer @huage1994
FYI, it's a kind of potential security issue so please review it if you have time.