25 lines
1.4 KiB
TypeScript
25 lines
1.4 KiB
TypeScript
import { describe, it, expect } from 'bun:test';
|
|
import { escapeLdapFilterValue } from '../src/lib/server/ldap-filter';
|
|
|
|
// Unit test stays import-light: it must NOT pull in `ldapts` (whose transitive
|
|
// `whatwg-url` dep does not always link in the CI per-step node_modules).
|
|
// The "does the escaped filter actually PARSE via ldapts" proof lives in the
|
|
// integration test tests/ldap-filter-parse.test.ts, which runs with full node_modules.
|
|
describe('escapeLdapFilterValue - RFC 4515 filter escaping (LDAP group check)', () => {
|
|
it("escapes a backslash so an AD DN with an escaped comma is safe in a filter (the reported bug)", () => {
|
|
// CN=Surname\, Name,... - a real AD DN. Raw, ldapts reads `\,` as an invalid `\XX`
|
|
// hex escape and throws "Invalid escaped hex character". Escaped (\\ -> \5c) it parses.
|
|
const dn = 'CN=Surname\\, Name,OU=Group,OU=Users,DC=example,DC=com';
|
|
const escaped = escapeLdapFilterValue(dn);
|
|
expect(escaped).toContain('\\5c'); // backslash was hex-escaped
|
|
expect(escaped).not.toContain('\\,'); // no bare backslash-comma left
|
|
});
|
|
it('escapes filter metacharacters ( ) * NUL', () => {
|
|
expect(escapeLdapFilterValue('a(b)c*d')).toBe('a\\28b\\29c\\2ad');
|
|
expect(escapeLdapFilterValue('x\0y')).toBe('x\\00y');
|
|
});
|
|
it('leaves a plain value untouched', () => {
|
|
expect(escapeLdapFilterValue('CN=jsmith,OU=Users,DC=example,DC=com')).toBe('CN=jsmith,OU=Users,DC=example,DC=com');
|
|
});
|
|
});
|