Andrey Antukh 96f6a295e7 🐛 Escape LDAP filter values and use directory email in retrieve-user ...

Fix LDAP injection vulnerability (T5-N1-03) where the client-supplied email was used directly in the LDAP search filter without escaping RFC 4515 special characters (*, (, ), \, NUL), and the profile email was taken from client input instead of the LDAP directory attribute.

Changes:
- Add escape-ldap-filter-value per RFC 4515 section 3
- Apply escaping in search-user before building LDAP filter
- Add get-attr helper for multi-valued LDAP attributes
- Fix retrieve-user to use directory email (attrs-email) instead of client email
- Use cuerdas.core instead of clojure.string

Closes #11084

AI-assisted-by: mimo-v2.5-pro

2026-08-05 11:23:17 +02:00

..

helpers

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00

asset-download.test.mjs

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00

auth-flow.test.mjs

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00

config.mjs

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00

export-binfile.test.mjs

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00

ldap-injection.test.mjs

🐛 Escape LDAP filter values and use directory email in retrieve-user

2026-08-05 11:23:17 +02:00