From 23b57dc573ed3a50710bccf77e416b955763763a Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Sat, 25 Jul 2026 04:31:25 +0000
Subject: [PATCH] Fix java/regex-injection CodeQL alert in TargAttrFilters (#760)

---
 opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/TargAttrFilters.java |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/TargAttrFilters.java b/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/TargAttrFilters.java
index 42ede7a..367616c 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/TargAttrFilters.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/TargAttrFilters.java
@@ -13,6 +13,7 @@
  *
  * Copyright 2008 Sun Microsystems, Inc.
  * Portions Copyright 2013-2016 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC.
  */
 package org.opends.server.authorization.dseecompat;
 
@@ -137,9 +138,12 @@
         //This pattern is built dynamically and is used to see if the operations
         //in the two filter list parts (if the second exists) are equal. See
         //comment below.
+        // firstOp is captured from the (add|del) group of keywordFullPattern, so it can
+        // only ever be the literal "add" or "del". Quote it defensively before embedding it
+        // into another regular expression to avoid any regex-injection into opPattern.
         String opPattern=
                 "[,]{1}" + ZERO_OR_MORE_WHITESPACE  +
-                firstOp + ZERO_OR_MORE_WHITESPACE + EQUAL_SIGN +
+                Pattern.quote(firstOp) + ZERO_OR_MORE_WHITESPACE + EQUAL_SIGN +
                 ZERO_OR_MORE_WHITESPACE;
         String[] temp=subExpression.split(opPattern);
         /*

--
Gitblit v1.10.0