Encode LDAP query parameter names as well (#3288)

Author: coheigea

rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitor.java

@@ -60,8 +60,9 @@ public void visit(SearchCondition<T> sc) {
                 }
 
                 String ldapOperator = conditionTypeToLdapOperator(sc.getConditionType());
+                String encodedName = encodeQueryValues ? Util.doRFC2254Encoding(name) : name;
                 String encodedRValStr = encodeQueryValues ? Util.doRFC2254Encoding(rvalStr) : rvalStr;
-                sb.append(name).append(ldapOperator).append(encodedRValStr);
+                sb.append(encodedName).append(ldapOperator).append(encodedRValStr);
 
                 sb.append(')');
             }

rt/rs/extensions/search/src/test/java/org/apache/cxf/jaxrs/ext/search/ldap/LdapQueryVisitorTest.java

@@ -20,8 +20,11 @@
 
 import java.util.Date;
 
+import org.apache.cxf.jaxrs.ext.search.ConditionType;
+import org.apache.cxf.jaxrs.ext.search.SearchBean;
 import org.apache.cxf.jaxrs.ext.search.SearchCondition;
 import org.apache.cxf.jaxrs.ext.search.SearchParseException;
+import org.apache.cxf.jaxrs.ext.search.SimpleSearchCondition;
 import org.apache.cxf.jaxrs.ext.search.fiql.FiqlParser;
 
 import org.junit.Ignore;
@@ -86,6 +89,18 @@ public void testComplexQuery() throws SearchParseException {
         assertEquals("(&(|(name=test)(level=18))(|(name=test1)(!level=19)))", ldap);
     }
 
+    @Test
+    public void testLdapFilterInjectionViaUnencodedPropertyName() throws SearchParseException {
+        SearchBean bean = new SearchBean();
+        bean.set("cn)(|(sn", "admin");
+
+        SearchCondition<SearchBean> filter =
+            new SimpleSearchCondition<>(ConditionType.EQUALS, bean);
+        LdapQueryVisitor<SearchBean> visitor = new LdapQueryVisitor<>();
+        filter.accept(visitor.visitor());
+
+        assertEquals("(cn\\29\\28|\\28sn=admin)", visitor.getQuery());
+    }
 
     @Ignore
     public static class Condition {