Change #282082

Comments

ldap: base64-encode a non-SAFE DN and reject a control-byte type name

The LDIF output already base64-encodes attribute values that are not RFC
2849 SAFE-STRINGs, but the entry DN and the attribute type names were
still written verbatim. A hostile or MITM LDAP server that returns a DN
or a type name containing CR/LF could therefore inject its own lines
into the LDIF that curl prints.

Follow RFC 2849 for those two fields as well: write a non-SAFE DN in the
"DN:: <base64>" form, and reject a type name that carries a control byte
(a type has no base64 form in LDIF and a conformant one never contains
one). The SAFE-STRING test is factored into one helper per backend and
the existing value check now shares it. Applies to both the OpenLDAP
(lib/openldap.c) and the generic/WinLDAP (lib/ldap.c) backends.

Closes #22945

Changed files

• lib/ldap.c
• lib/openldap.c