dotnet / dotnet/runtime

System.DirectoryServices.Protocols.SearchRequest Filter does not allow unnecessary space-escapes unlike on Windows

Open
#127,175 2 comments 0 reactions 0 assignees View on GitHub
area-System.DirectoryServices help wanted
Dominant language
C#
Stars
18.3k
Forks
5.6k
PR merge metrics
PR metrics pending

Description

### Description

When writing an ldap filter with a space in it, a leading backslash is needed if the space is at the beginning or end of the entry. For simplicity, it's common practice to backslash-escape *any* space in an LDAP query. This is not permitted on Linux, but is on Windows.

Invoking through powershell:

```ps
$conn.SendRequest([System.DirectoryServices.Protocols.SearchRequest]::new(
"DC=samdom,DC=example,DC=com",
"(&(objectClass=organizationalUnit)(distinguishedName=OU=Domain\ Controllers,DC=samdom,DC=example,DC=com))",
"subtree",
"*"
))
```

is permitted on Windows but fails on Linux.

Note that I have not tested space-at-the-beginning-and-end behaviour, only internal spaces because that's what comes up more frequently.

### Reproduction Steps

using the following docker-compose.yml to create an LDAP server on localhost:

```yaml
services:
smblds:
environment:
- INSECURE_LDAP=true
image: 'smblds/smblds:latest'
ports:
- 389:389
- 636:636
```

Invoke the following (using pwsh to demonstrate).

```ps
Add-Type -path $assemblyPath

# default credentials for `smblds` for testing purposes.
$credential = [Management.Automation.PSCredential]::new('SAMDOM\Administrator', (ConvertTo-SecureString 'Passw0rd' -AsPlainText -Force))
$identifier = [System.DirectoryServices.Protocols.LdapDirectoryIdentifier]::new('localhost', 389)
$conn = [System.DirectoryServices.Protocols.LDAPConnection]::new($identifier, $credential, 'Basic')
$result = $null
$conn.SendRequest([System.DirectoryServices.Protocols.SearchRequest]::new(
"DC=samdom,DC=example,DC=com",
"(&(objectClass=organizationalUnit)(distinguishedName=OU=Domain\ Controllers,DC=samdom,DC=example,DC=com))",
"subtree",
"*"
))
```

Works fine in pwsh (which uses netcore) and PS5.1 (which uses framework) but fails on linux.

### Expected behavior

Return OrganizationalUnit searchresponse.

### Actual behavior

> MethodInvocationException: Exception calling "SendRequest" with "1" argument(s): "The search filter is invalid."

### Regression?

_No response_

### Known Workarounds

_No response_

### Configuration

Ubuntu 22.04, .NET 8.0, x64

### Other information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.