From d87b0344404990e1e8de066d5fb6878ce2f65861 Mon Sep 17 00:00:00 2001 From: darthpbal Date: Thu, 30 Jul 2015 12:23:36 -0700 Subject: [PATCH 1/2] Added tweaks to escapeManual() and escapeManualWithFlags() in src/Connections/Ldap.php, and added tests to tests/ConnectionTests.php to correct adLDAP's manual version of PPHP 5.6 ldap_escape() which improperly escapes in some contexts. --- src/Connections/Ldap.php | 10 +++- tests/ConnectionTest.php | 114 ++++++++++++++++++++++++++++++++++++++- 2 files changed, 121 insertions(+), 3 deletions(-) diff --git a/src/Connections/Ldap.php b/src/Connections/Ldap.php index 3790b06..92b12d8 100644 --- a/src/Connections/Ldap.php +++ b/src/Connections/Ldap.php @@ -743,6 +743,8 @@ protected function escapeManual($value, $ignore = '', $flags = 0) // Go through each character to ignore foreach ($ignores as $charToIgnore) { + // Avoid accidentally removing backslashes on line 752 by skipping blank ignores chars + if(!$charToIgnore) continue; // Convert the character to ignore to a hex $hexed = bin2hex($charToIgnore); @@ -783,8 +785,12 @@ protected function escapeManualWithFlags($value, $ignore = '', $flags = 0) $escapes = $escapeDn; break; case 3: - // If both LDAP_ESCAPE_FILTER and LDAP_ESCAPE_DN are used - $escapes = array_merge($escapeFilter, $escapeDn); + // If both LDAP_ESCAPE_FILTER and LDAP_ESCAPE_DN are used. + /* + * array_slice was added here to remove the first '\' in escapeDn + * which would escape all of the characters from $escapeFilter + */ + $escapes = array_merge($escapeFilter, array_slice($escapeDn, 1)); break; default: return false; diff --git a/tests/ConnectionTest.php b/tests/ConnectionTest.php index b63e59e..94ba0b4 100644 --- a/tests/ConnectionTest.php +++ b/tests/ConnectionTest.php @@ -90,10 +90,122 @@ public function testEscapeManualBothFilterAndDn() $ldap->shouldAllowMockingProtectedMethods(true); - $expected = 'testing\3d\2b\3c\3e\22\22\3b:\23\5c28\5c29*\5c5cx00'; + $expected = 'testing\3d\2b\3c\3e\22\22\3b:\23\28\29*\5cx00'; $result = $ldap->escapeManual('testing=+<>"";:#()*\x00', '*', 3); $this->assertEquals($expected, $result); } + + /** + * Where tests specific to manually + * escaping strings if ldap_escape() + * is not available. + * + * Edits made to src/Connections/Ldap.php + * lines 747 & 793 + */ + public function testEscapeManualNoIgnoreFlag0() + { + $stringToEscape = 'abc123\*(),=+<>;"#'; + $expectedOutput = '\61\62\63\31\32\33\5c\2a\28\29\2c\3d\2b\3c\3e\3b\22\23'; + $flags =0; + $ignore = ''; + + $ldap = $this->mock('Adldap\Connections\Ldap')->makePartial(); + $ldap->shouldAllowMockingProtectedMethods(true); + $result = $ldap->escapeManual($stringToEscape, $ignore, $flags); + $this->assertEquals($expectedOutput, $result); + } + + public function testEscapeManualNoIgnoreFlag1() + { + $stringToEscape = 'abc123\*(),=+<>;"#'; + $expectedOutput = 'abc123\5c\2a\28\29,=+<>;"#'; + $flags =1; + $ignore = ''; + + $ldap = $this->mock('Adldap\Connections\Ldap')->makePartial(); + $ldap->shouldAllowMockingProtectedMethods(true); + $result = $ldap->escapeManual($stringToEscape, $ignore, $flags); + $this->assertEquals($expectedOutput, $result); + } + + public function testEscapeManualNoIgnoreFlag2() + { + $stringToEscape = 'abc123\*(),=+<>;"#'; + $expectedOutput = 'abc123\5c*()\2c\3d\2b\3c\3e\3b\22\23'; + $flags =2; + $ignore = ''; + + $ldap = $this->mock('Adldap\Connections\Ldap')->makePartial(); + $ldap->shouldAllowMockingProtectedMethods(true); + $result = $ldap->escapeManual($stringToEscape, $ignore, $flags); + $this->assertEquals($expectedOutput, $result); + } + + public function testEscapeManualNoIgnoreFlag3() + { + $stringToEscape = 'abc123\*(),=+<>;"#'; + $expectedOutput = 'abc123\5c\2a\28\29\2c\3d\2b\3c\3e\3b\22\23'; + $flags =3; + $ignore = ''; + + $ldap = $this->mock('Adldap\Connections\Ldap')->makePartial(); + $ldap->shouldAllowMockingProtectedMethods(true); + $result = $ldap->escapeManual($stringToEscape, $ignore, $flags); + $this->assertEquals($expectedOutput, $result); + } + + public function testEscapeManualIgnore321Flag0() + { + $stringToEscape = 'abc123\*(),=+<>;"#'; + $expectedOutput = '\61\62\63123\5c\2a\28\29\2c\3d\2b\3c\3e\3b\22\23'; + $flags =0; + $ignore = '321'; + + $ldap = $this->mock('Adldap\Connections\Ldap')->makePartial(); + $ldap->shouldAllowMockingProtectedMethods(true); + $result = $ldap->escapeManual($stringToEscape, $ignore, $flags); + $this->assertEquals($expectedOutput, $result); + } + + public function testEscapeManualIgnore321Flag1() + { + $stringToEscape = 'abc123\*(),=+<>;"#'; + $expectedOutput = 'abc123\5c\2a\28\29,=+<>;"#'; + $flags =1; + $ignore = '321'; + + $ldap = $this->mock('Adldap\Connections\Ldap')->makePartial(); + $ldap->shouldAllowMockingProtectedMethods(true); + $result = $ldap->escapeManual($stringToEscape, $ignore, $flags); + $this->assertEquals($expectedOutput, $result); + } + + public function testEscapeManualIgnore321Flag2() + { + $stringToEscape = 'abc123\*(),=+<>;"#'; + $expectedOutput = 'abc123\5c*()\2c\3d\2b\3c\3e\3b\22\23'; + $flags =2; + $ignore = '321'; + + $ldap = $this->mock('Adldap\Connections\Ldap')->makePartial(); + $ldap->shouldAllowMockingProtectedMethods(true); + $result = $ldap->escapeManual($stringToEscape, $ignore, $flags); + $this->assertEquals($expectedOutput, $result); + } + + public function testEscapeManualIgnore321Flag3() + { + $stringToEscape = 'abc123\*(),=+<>;"#'; + $expectedOutput = 'abc123\5c\2a\28\29\2c\3d\2b\3c\3e\3b\22\23'; + $flags =3; + $ignore = '321'; + + $ldap = $this->mock('Adldap\Connections\Ldap')->makePartial(); + $ldap->shouldAllowMockingProtectedMethods(true); + $result = $ldap->escapeManual($stringToEscape, $ignore, $flags); + $this->assertEquals($expectedOutput, $result); + } } \ No newline at end of file From 1b975ffea706c885306fdea26242836798e3f812 Mon Sep 17 00:00:00 2001 From: Darthpbal Date: Thu, 30 Jul 2015 12:31:13 -0700 Subject: [PATCH 2/2] Added comment change inside testEscapeManualBothFilterAndDn() test method. --- tests/ConnectionTest.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/ConnectionTest.php b/tests/ConnectionTest.php index 94ba0b4..c670782 100644 --- a/tests/ConnectionTest.php +++ b/tests/ConnectionTest.php @@ -89,7 +89,9 @@ public function testEscapeManualBothFilterAndDn() $ldap = $this->mock('Adldap\Connections\Ldap')->makePartial(); $ldap->shouldAllowMockingProtectedMethods(true); - + + // echo ldap_escape('testing=+<>"";:#()*\x00'); + // results in 'testing\3d\2b\3c\3e\22\22\3b:\23\28\29*\5cx00' $expected = 'testing\3d\2b\3c\3e\22\22\3b:\23\28\29*\5cx00'; $result = $ldap->escapeManual('testing=+<>"";:#()*\x00', '*', 3); @@ -208,4 +210,4 @@ public function testEscapeManualIgnore321Flag3() $result = $ldap->escapeManual($stringToEscape, $ignore, $flags); $this->assertEquals($expectedOutput, $result); } -} \ No newline at end of file +}