EscapeLDAPValue - catch trailing escape character (#13452)

* [VAULT-4018] - EscapeLDAPValue catch trailing escape character
hashicorp · Dec 15, 2021 · eadbe96 · eadbe96
1 parent 8bcf5c9
commit eadbe96
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 1 deletion.
diff --git a/changelog/13452.txt b/changelog/13452.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+sdk/helper/ldaputil: properly escape a trailing escape character to prevent panics.
+```
diff --git a/sdk/helper/ldaputil/client.go b/sdk/helper/ldaputil/client.go
@@ -512,7 +512,7 @@ func EscapeLDAPValue(input string) string {
 	// - null
 	for i := 0; i < len(input); i++ {
 		escaped := false
-		if input[i] == '\\' {
+		if input[i] == '\\' && i+1 < len(input)-1 {
 			i++
 			escaped = true
 		}

diff --git a/sdk/helper/ldaputil/client_test.go b/sdk/helper/ldaputil/client_test.go
@@ -32,6 +32,9 @@ func TestLDAPEscape(t *testing.T) {
 		"test\\hello": "test\\\\hello",
 		"  test  ":    "\\  test \\ ",
 		"":            "",
+		"\\test":      "\\\\test",
+		"test\\":      "test\\\\",
+		"test\\ ":     "test\\\\\\ ",
 	}
 
 	for test, answer := range testcases {