[CXF-7701] Encode JAX-RS Search query values for the LdapQueryVisitor

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.2.4
• Fix Version/s: 3.2.5
• Estimated Complexity: Unknown
• Assignee: Colm O hEigeartaigh
• Reporter: Colm O hEigeartaigh
• Created: 05/Apr/18 12:12
• Updated: 06/Sep/19 14:22
• Resolved: 05/Apr/18 12:57

Description

When using JAX-RS search with the LdapQueryVisitor, we don't encode the query value by default. This means that an LDAP injection attack is possible. By default we should encode query values (and make it configurable if the user wants to support searching using wildcards for example).

Issue Links

• links to: GitHub Pull Request #576