From 07bad95016f2cfafaf217114f9b0b50429af7d2f Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Sun, 12 Jul 2026 12:06:03 +0000
Subject: [PATCH] [#726] Reject malformed bracketed IPv6 hosts in HostPort (#732)
---
opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/UserDNTestCase.java | 45 +++++++++++++++++++++++++++++++++++++++++++++
1 files changed, 45 insertions(+), 0 deletions(-)
diff --git a/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/UserDNTestCase.java b/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/UserDNTestCase.java
index fac597f..9fbc728 100644
--- a/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/UserDNTestCase.java
+++ b/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/UserDNTestCase.java
@@ -53,4 +53,49 @@
{
Aci.decode(ByteString.valueOfUtf8(aciString), DN.rootDN());
}
+
+ /**
+ * ACIs whose userdn LDAP URL contains a malformed bracketed IPv6 host - see
+ * issue #726.
+ *
+ * @return The malformed ACIs.
+ */
+ @DataProvider
+ public Object[][] malformedIPv6HostAcis()
+ {
+ return new Object[][] {
+ { "(version 3.0; acl \"f\"; allow (search) userdn=\"q://[:1\"; )" },
+ { "(version 3.0; acl \"f\"; allow (search) userdn=\"ldap://[::1:389/dc=example,dc=com\"; )" },
+ };
+ }
+
+ /**
+ * A malformed bracketed IPv6 host in the userdn URL must be rejected with a
+ * clean AciException instead of a StringIndexOutOfBoundsException - see
+ * issue #726.
+ *
+ * @param aciString
+ * The ACI to decode.
+ * @throws Exception
+ * If an unexpected exception occurred.
+ */
+ @Test(dataProvider = "malformedIPv6HostAcis", expectedExceptions = AciException.class)
+ public void testMalformedIPv6HostInUserDN(String aciString) throws Exception
+ {
+ Aci.decode(ByteString.valueOfUtf8(aciString), DN.rootDN());
+ }
+
+ /**
+ * A well-formed bracketed IPv6 host in the userdn URL must still decode.
+ *
+ * @throws Exception
+ * If an unexpected exception occurred.
+ */
+ @Test
+ public void testValidIPv6HostInUserDN() throws Exception
+ {
+ String aciString = "(version 3.0; acl \"f\"; allow (search) "
+ + "userdn=\"ldap://[::1]:389/uid=user,dc=example,dc=com\"; )";
+ Aci.decode(ByteString.valueOfUtf8(aciString), DN.rootDN());
+ }
}
--
Gitblit v1.10.0