Do not escape password for LDAP connectors (#3470)

nabokihms · web-flow · commit 3705207f0190 · 2024-04-09T13:05:06.000+02:00
With the change introduced in #3372 Dex declines passwords that contain special characters. Since password is not passed to any kind of filters, it is safe to pass a password as is. No LDAP query injections are possible. This commit is a revert of password escaping. Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
diff --git a/connector/ldap/ldap.go b/connector/ldap/ldap.go
@@ -473,7 +473,6 @@ func (c *ldapConnector) Login(ctx context.Context, s connector.Scopes, username,
 	)
 
 	username = ldap.EscapeFilter(username)
-	password = ldap.EscapeFilter(password)
 
 	err = c.do(ctx, func(conn *ldap.Conn) error {
 		entry, found, err := c.userEntry(conn, username)

Original file line number	Diff line number	Diff line change
`@@ -473,7 +473,6 @@ func (c *ldapConnector) Login(ctx context.Context, s connector.Scopes, username,`
`473`	`473`	`)`
`474`	`474`
`475`	`475`	`username = ldap.EscapeFilter(username)`
`476`		`- password = ldap.EscapeFilter(password)`
`477`	`476`
`478`	`477`	`err = c.do(ctx, func(conn *ldap.Conn) error {`
`479`	`478`	`entry, found, err := c.userEntry(conn, username)`