From 6399d638df9570b9a4537beffeb214dca253fcae Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Wed, 08 Jul 2026 17:19:12 +0000
Subject: [PATCH] [#712] Fix StringIndexOutOfBoundsException on blank bind rule in ACI (#715)
---
opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciBodyTest.java | 12 ++++++++++++
1 files changed, 12 insertions(+), 0 deletions(-)
diff --git a/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciBodyTest.java b/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciBodyTest.java
index b006df4..ed3f15a 100644
--- a/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciBodyTest.java
+++ b/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciBodyTest.java
@@ -12,6 +12,7 @@
* information: "Portions Copyright [year] [name of copyright owner]".
*
* Copyright 2013-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC
*/
package org.opends.server.authorization.dseecompat;
@@ -61,4 +62,15 @@
assertThat(aciBody.toString()).isEqualTo(aci);
assertThat(aciBody.getPermBindRulePairs()).hasSize(1);
}
+
+ /**
+ * A blank bind rule (only whitespace between the parentheses) must be
+ * rejected with an {@link AciException} rather than crashing with an
+ * unchecked {@code StringIndexOutOfBoundsException}. See issue #712.
+ */
+ @Test(expectedExceptions = AciException.class)
+ public void decodeBlankBindRuleThrowsAciException() throws Exception
+ {
+ AciBody.decode("(version 3.0; acl \"C\"; allow (search)( ) (userdn=\"ldap:///self\"); )");
+ }
}
--
Gitblit v1.10.0