Andrey Antukh 96f6a295e7 🐛 Escape LDAP filter values and use directory email in retrieve-user ...

Fix LDAP injection vulnerability (T5-N1-03) where the client-supplied email was used directly in the LDAP search filter without escaping RFC 4515 special characters (*, (, ), \, NUL), and the profile email was taken from client input instead of the LDAP directory attribute.

Changes:
- Add escape-ldap-filter-value per RFC 4515 section 3
- Apply escaping in search-user before building LDAP filter
- Add get-attr helper for multi-valued LDAP attributes
- Fix retrieve-user to use directory email (attrs-email) instead of client email
- Use cuerdas.core instead of clojure.string

Closes #11084

AI-assisted-by: mimo-v2.5-pro

2026-08-05 11:23:17 +02:00

..

dev

♻️ Refactor internal organization of system initialization

2026-07-22 14:18:51 +02:00

resources

♻️ Normalize organization naming across Penpot (#10977)

2026-07-31 12:04:10 +02:00

scripts

🐛 Escape LDAP filter values and use directory email in retrieve-user

2026-08-05 11:23:17 +02:00

src

🐛 Escape LDAP filter values and use directory email in retrieve-user

2026-08-05 11:23:17 +02:00

test

🐛 Escape LDAP filter values and use directory email in retrieve-user

2026-08-05 11:23:17 +02:00

build.clj

🐛 Fix unexpected exception on logger caused by log4j2 plugin

2023-02-11 00:52:23 +01:00

deps.edn

⬆️ Update dependencies (#10982)

2026-07-31 18:53:05 +02:00

package.json

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00

pnpm-lock.yaml

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00

pnpm-workspace.yaml

⬆️ Update pnpm dependencies across all modules

2026-08-04 14:15:35 +02:00

tests.edn

🔧 Change backend test runner to kaocha

2024-05-29 19:05:04 +02:00