From 23b57dc573ed3a50710bccf77e416b955763763a Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Sat, 25 Jul 2026 04:31:25 +0000
Subject: [PATCH] Fix java/regex-injection CodeQL alert in TargAttrFilters (#760)
---
opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/TargAttrFilters.java | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/TargAttrFilters.java b/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/TargAttrFilters.java
index 42ede7a..367616c 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/TargAttrFilters.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/TargAttrFilters.java
@@ -13,6 +13,7 @@
*
* Copyright 2008 Sun Microsystems, Inc.
* Portions Copyright 2013-2016 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC.
*/
package org.opends.server.authorization.dseecompat;
@@ -137,9 +138,12 @@
//This pattern is built dynamically and is used to see if the operations
//in the two filter list parts (if the second exists) are equal. See
//comment below.
+ // firstOp is captured from the (add|del) group of keywordFullPattern, so it can
+ // only ever be the literal "add" or "del". Quote it defensively before embedding it
+ // into another regular expression to avoid any regex-injection into opPattern.
String opPattern=
"[,]{1}" + ZERO_OR_MORE_WHITESPACE +
- firstOp + ZERO_OR_MORE_WHITESPACE + EQUAL_SIGN +
+ Pattern.quote(firstOp) + ZERO_OR_MORE_WHITESPACE + EQUAL_SIGN +
ZERO_OR_MORE_WHITESPACE;
String[] temp=subExpression.split(opPattern);
/*
--
Gitblit v1.10.0