feat: add support for escaped characters in searches

Author: stakach

src/ldap/request/filter.cr

@@ -14,6 +14,29 @@ class LDAP::Request::Filter
     Extensible
   end
 
+  ESCAPES = {
+    "\0" => "\\00", # NUL            = %x00 ; null character
+    "*"  => "\\2A", # ASTERISK       = %x2A ; asterisk ("*")
+    "("  => "\\28", # LPARENS        = %x28 ; left parenthesis ("(")
+    ")"  => "\\29", # RPARENS        = %x29 ; right parenthesis (")")
+    "\\" => "\\5C", # ESC            = %x5C ; esc (or backslash) ("\")
+  }
+  # Compiled character class regexp using the keys from the above hash.
+  ESCAPE_RE = Regex.new(String.build { |str|
+    str << "["
+    ESCAPES.keys.each { |e| str << Regex.escape(e) }
+    str << "]"
+  })
+
+  # Escape a string for use in an LDAP filter
+  def self.escape(string : String) : String
+    string.gsub(ESCAPE_RE) { |char| ESCAPES[char] }
+  end
+
+  def self.unescape(value : String, escaped : Bool = false) : String
+    escaped ? value.gsub(/\\([a-fA-F\d]{2})/) { String.new($1.hexbytes) } : value
+  end
+
   def initialize(@operation : Type, @filter : BER)
   end
 
@@ -27,7 +50,7 @@ class LDAP::Request::Filter
     to_ber.to_slice
   end
 
-  def self.equal(object : String, value)
+  def self.equal(object : String, value, escaped : Bool = false)
     value = value.to_s
     if value == "*"
       self.new(Type::Equal, BER.new.set_string(object, 7, TagClass::ContextSpecific))
@@ -38,17 +61,17 @@ class LDAP::Request::Filter
         first = nil
         ary.shift
       else
-        first = BER.new.set_string(ary.shift, 0, TagClass::ContextSpecific)
+        first = BER.new.set_string(unescape(ary.shift, escaped), 0, TagClass::ContextSpecific)
       end
 
       if ary.last.empty?
         last = nil
         ary.pop
       else
-        last = BER.new.set_string(ary.pop, 2, TagClass::ContextSpecific)
+        last = BER.new.set_string(unescape(ary.pop, escaped), 2, TagClass::ContextSpecific)
       end
 
-      seq = ary.map { |e| BER.new.set_string(e, 1, TagClass::ContextSpecific) }
+      seq = ary.map { |e| BER.new.set_string(unescape(e, escaped), 1, TagClass::ContextSpecific) }
       seq.unshift first if first
       seq.push last if last
       seq = LDAP.sequence(seq)
@@ -57,7 +80,7 @@ class LDAP::Request::Filter
       self.new(Type::Equal, LDAP.context_sequence({left, seq}, 4))
     else
       left = BER.new.set_string(object, UniversalTags::OctetString)
-      right = BER.new.set_string(value, UniversalTags::OctetString)
+      right = BER.new.set_string(unescape(value, escaped), UniversalTags::OctetString)
       self.new(Type::Equal, LDAP.context_sequence({left, right}, 3))
     end
   end
@@ -74,10 +97,10 @@ class LDAP::Request::Filter
     self.new(Type::LessThanOrEqual, LDAP.context_sequence({left, right}, 6))
   end
 
-  def self.not_equal(object : String, value)
+  def self.not_equal(object : String, value, escaped : Bool = false)
     self.new(
       Type::NotEqual,
-      LDAP.context_sequence({equal(object, value).to_ber}, 2)
+      LDAP.context_sequence({equal(object, value, escaped).to_ber}, 2)
     )
   end
 
@@ -105,6 +128,22 @@ class LDAP::Request::Filter
     self.new(Type::Or, LDAP.context_sequence({left.to_ber, right.to_ber}, 1))
   end
 
+  def self.begins(attribute : String, value)
+    equal(attribute, "#{escape(value.to_s)}*", escaped: true)
+  end
+
+  def self.ends(attribute : String, value)
+    equal(attribute, "*#{escape(value.to_s)}", escaped: true)
+  end
+
+  def self.contains(attribute : String, value)
+    equal(attribute, "*#{escape(value.to_s)}*", escaped: true)
+  end
+
+  def self.present?(attribute : String)
+    equal(attribute, "*")
+  end
+
   # Joins two or more filters so that all conditions must be true.
   def &(filter)
     self.class.join(self, filter)

src/ldap/request/filter_parser.cr

@@ -36,9 +36,9 @@ class LDAP::Request::FilterParser
           value = value.strip
           case op
           when "="
-            Filter.equal(token, value)
+            Filter.equal(token, value, escaped: true)
           when "!="
-            Filter.not_equal(token, value)
+            Filter.not_equal(token, value, escaped: true)
           when "<="
             Filter.less_than(token, value)
           when ">="