From 6399d638df9570b9a4537beffeb214dca253fcae Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Wed, 08 Jul 2026 17:19:12 +0000
Subject: [PATCH] [#712] Fix StringIndexOutOfBoundsException on blank bind rule in ACI (#715)

---
 opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/BindRule.java |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/BindRule.java b/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/BindRule.java
index 8952ea6..288a28f 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/BindRule.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/BindRule.java
@@ -146,11 +146,17 @@
      * @throws AciException If the string is an invalid bind rule.
      */
     public static BindRule decode (String input) throws AciException {
-        if (input == null || input.length() == 0)
+        if (input == null)
         {
           return null;
         }
         String bindruleStr = input.trim();
+        if (bindruleStr.isEmpty())
+        {
+          // A blank bind rule (e.g. "(          )") must be rejected as a
+          // syntax error rather than throwing StringIndexOutOfBoundsException.
+          return null;
+        }
         char firstChar = bindruleStr.charAt(0);
         char[] bindruleArray = bindruleStr.toCharArray();
 

--
Gitblit v1.10.0