From dc3e65ec81705f75d8760b628fd8b395bfa0e6ec Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Tue, 28 Jul 2026 16:18:44 +0000
Subject: [PATCH] Fix java/overly-large-range CodeQL alerts by correcting the A-z letter ranges (#779)
---
opendj-server-legacy/src/main/java/org/opends/server/backends/cassandra/Storage.java | 6 +++---
opendj-core/src/test/java/org/forgerock/opendj/ldap/AddressMaskTestCase.java | 14 ++++++++++++--
opendj-core/src/main/java/org/forgerock/opendj/ldap/AddressMask.java | 5 +++--
3 files changed, 18 insertions(+), 7 deletions(-)
diff --git a/opendj-core/src/main/java/org/forgerock/opendj/ldap/AddressMask.java b/opendj-core/src/main/java/org/forgerock/opendj/ldap/AddressMask.java
index 13d222e..ba958df 100644
--- a/opendj-core/src/main/java/org/forgerock/opendj/ldap/AddressMask.java
+++ b/opendj-core/src/main/java/org/forgerock/opendj/ldap/AddressMask.java
@@ -13,6 +13,7 @@
*
* Copyright 2006-2009 Sun Microsystems, Inc.
* Portions copyright 2011-2014 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
*/
package org.forgerock.opendj.ldap;
@@ -328,7 +329,7 @@
*/
private void processHost(final String rule) {
// Note that '*' is valid in host rule
- final String[] s = rule.split("^[0-9a-zA-z-.*]+");
+ final String[] s = rule.split("^[0-9a-zA-Z_.*-]+");
if (s.length > 0) {
throw genericDecodeError();
}
@@ -346,7 +347,7 @@
*/
private void processHostPattern(final String rule) {
// quick check for invalid chars like " "
- final String[] s = rule.split("^[0-9a-zA-z-.]+");
+ final String[] s = rule.split("^[0-9a-zA-Z_.-]+");
if (s.length > 0) {
throw genericDecodeError();
}
diff --git a/opendj-core/src/test/java/org/forgerock/opendj/ldap/AddressMaskTestCase.java b/opendj-core/src/test/java/org/forgerock/opendj/ldap/AddressMaskTestCase.java
index 7dffda5..76b6601 100644
--- a/opendj-core/src/test/java/org/forgerock/opendj/ldap/AddressMaskTestCase.java
+++ b/opendj-core/src/test/java/org/forgerock/opendj/ldap/AddressMaskTestCase.java
@@ -13,6 +13,7 @@
*
* Copyright 2006-2008 Sun Microsystems, Inc.
* Portions copyright 2011-2015 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
*/
package org.forgerock.opendj.ldap;
@@ -38,7 +39,9 @@
public Object[][] validData() {
return new Object[][] { { "129.34.55.67" }, { "129.*.78.55" }, { ".central.sun.com" },
{ "foo.central.sun.com" }, { "foo.*.sun.*" }, { "128.*.*.*" }, { "129.45.23.67/22" },
- { "128.33.23.21/32" }, { "*.*.*.*" }, { "129.45.67.34/0" }, { "foo.com" }, { "foo" } };
+ { "128.33.23.21/32" }, { "*.*.*.*" }, { "129.45.67.34/0" }, { "foo.com" }, { "foo" },
+ // Underscores appear in real deployments and stay accepted.
+ { "my_host.example.com" }, { ".my_domain.com" } };
}
@DataProvider(name = "invalidRules")
@@ -47,7 +50,14 @@
{ "129.56.78.90/2000" }, { "677.777.AG.BC" }, { "/34" }, { "234.12.12.*/31" },
{ "234.12.12.90/" }, { "129.34.56.78/-100" }, { "129" }, { "129.34.-90.67" },
{ "129.**.56.67" }, { "foo bar.com" }, { "12foo.example.com" }, { "123.45." },
- { ".central.sun day.com" }, { "129.34.45.45/4/3/" } };
+ { ".central.sun day.com" }, { "129.34.45.45/4/3/" },
+ /*
+ * The characters between 'Z' and 'a' used to slip through the host and host
+ * pattern validators, which spelled the letter range as A-z instead of A-Z.
+ */
+ { "foo[bar.com" }, { "foo\\bar.com" }, { "foo]bar.com" }, { "foo^bar.com" },
+ { "foo`bar.com" }, { ".foo[bar.com" }, { ".foo\\bar.com" }, { ".foo]bar.com" },
+ { ".foo^bar.com" }, { ".foo`bar.com" } };
}
@DataProvider(name = "toStringRule")
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/backends/cassandra/Storage.java b/opendj-server-legacy/src/main/java/org/opends/server/backends/cassandra/Storage.java
index 56c8fae..3cb3d3b 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/backends/cassandra/Storage.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/backends/cassandra/Storage.java
@@ -11,7 +11,7 @@
* Header, with the fields enclosed by brackets [] replaced by your own identifying
* information: "Portions Copyright [year] [name of copyright owner]".
*
- * Copyright 2023-2024 3A Systems, LLC.
+ * Copyright 2023-2026 3A Systems, LLC.
*/
package org.opends.server.backends.cassandra;
@@ -147,11 +147,11 @@
}
String getKeyspaceName() {
- return "\""+System.getProperty("keyspace",config.getDBDirectory()).replaceAll("[^a-zA-z0-9_]", "_")+"\"";
+ return "\""+System.getProperty("keyspace",config.getDBDirectory()).replaceAll("[^a-zA-Z0-9_]", "_")+"\"";
}
String getTableName() {
- return getKeyspaceName()+".\""+config.getBackendId().replaceAll("[^a-zA-z0-9_]", "_")+"\"";
+ return getKeyspaceName()+".\""+config.getBackendId().replaceAll("[^a-zA-Z0-9_]", "_")+"\"";
}
@Override
--
Gitblit v1.10.0