From ad56836fce3025545f4f645ac58316d4749cf601 Mon Sep 17 00:00:00 2001
From: "witold.brzozowski" <witold.brzozowski@fingo.net>
Date: Tue, 22 Oct 2024 14:56:04 +0200
Subject: [PATCH] Ignore escaped commas when parsing active directory DNs

---
 .../config/ad/ActiveDirectoryUtils.java       |  3 ++-
 .../config/ad/tree/ActiveDirectoryNode.java   |  3 ++-
 .../config/ad/tree/ActiveDirectoryTree.java   |  3 ++-
 .../ActiveDirectoryUserLeaderProvider.java    |  4 ++-
 .../config/ad/ActiveDirectoryUtilsTest.groovy | 27 ++++++++++---------
 5 files changed, 23 insertions(+), 17 deletions(-)

diff --git a/src/main/java/info/fingo/urlopia/config/ad/ActiveDirectoryUtils.java b/src/main/java/info/fingo/urlopia/config/ad/ActiveDirectoryUtils.java
index 4394752..367b83c 100644
--- a/src/main/java/info/fingo/urlopia/config/ad/ActiveDirectoryUtils.java
+++ b/src/main/java/info/fingo/urlopia/config/ad/ActiveDirectoryUtils.java
@@ -56,7 +56,8 @@ public static String getRelativeDN(String distinguishedName,
     }
 
     public static String getParentDN(String distinguishedName) {
-        var dnParts = Arrays.stream(distinguishedName.split(",")).toList();
+        var commasIgnoringEscapedRegex = "(?<!\\\\),";
+        var dnParts = Arrays.stream(distinguishedName.split(commasIgnoringEscapedRegex)).toList();
         if (dnParts.size() == 1) {
             return "";
         } else {
diff --git a/src/main/java/info/fingo/urlopia/config/ad/tree/ActiveDirectoryNode.java b/src/main/java/info/fingo/urlopia/config/ad/tree/ActiveDirectoryNode.java
index ee771fc..a824d66 100644
--- a/src/main/java/info/fingo/urlopia/config/ad/tree/ActiveDirectoryNode.java
+++ b/src/main/java/info/fingo/urlopia/config/ad/tree/ActiveDirectoryNode.java
@@ -41,7 +41,8 @@ private static String getRDN(SearchResult object) {
     }
 
     private static String getRDN(String distinguishedName) {
-        return distinguishedName.split(",", 2)[0];
+        var commasIgnoringEscapedRegex = "(?<!\\\\),";
+        return distinguishedName.split(commasIgnoringEscapedRegex, 2)[0];
     }
 
     public List<SearchResult> getDirectChildrenObjects() {
diff --git a/src/main/java/info/fingo/urlopia/config/ad/tree/ActiveDirectoryTree.java b/src/main/java/info/fingo/urlopia/config/ad/tree/ActiveDirectoryTree.java
index 706c212..3b832ff 100644
--- a/src/main/java/info/fingo/urlopia/config/ad/tree/ActiveDirectoryTree.java
+++ b/src/main/java/info/fingo/urlopia/config/ad/tree/ActiveDirectoryTree.java
@@ -48,7 +48,8 @@ private Optional<ActiveDirectoryNode> searchNode(String distinguishedName) {
         if (relativeDn.isBlank()) {
             return Optional.of(root);
         }
-        var dnParts = Arrays.stream(relativeDn.split(",")).toList();
+        var commasIgnoringEscapedRegex = "(?<!\\\\),";
+        var dnParts = Arrays.stream(relativeDn.split(commasIgnoringEscapedRegex)).toList();
         return searchNode(root, dnParts);
     }
 
diff --git a/src/main/java/info/fingo/urlopia/user/ActiveDirectoryUserLeaderProvider.java b/src/main/java/info/fingo/urlopia/user/ActiveDirectoryUserLeaderProvider.java
index 35acfc0..b0d039a 100644
--- a/src/main/java/info/fingo/urlopia/user/ActiveDirectoryUserLeaderProvider.java
+++ b/src/main/java/info/fingo/urlopia/user/ActiveDirectoryUserLeaderProvider.java
@@ -70,7 +70,9 @@ private User getUserLeaderUnsafe(User user) throws NamingException {
     private List<String> extractOrganizationalUnitsDNs(String distinguishedName) {
         var result = new ArrayList<String>();
 
-        var components = distinguishedName.split(",");
+        var commasIgnoringEscapedRegex = "(?<!\\\\),";
+        var components = distinguishedName.split(commasIgnoringEscapedRegex);
+
         for (var i = 0; i < components.length; i++) {
             var component = components[i].trim();
             if (component.startsWith("OU=")) {
diff --git a/src/test/groovy/info/fingo/urlopia/config/ad/ActiveDirectoryUtilsTest.groovy b/src/test/groovy/info/fingo/urlopia/config/ad/ActiveDirectoryUtilsTest.groovy
index 6f62ba0..48dcd60 100644
--- a/src/test/groovy/info/fingo/urlopia/config/ad/ActiveDirectoryUtilsTest.groovy
+++ b/src/test/groovy/info/fingo/urlopia/config/ad/ActiveDirectoryUtilsTest.groovy
@@ -13,11 +13,12 @@ class ActiveDirectoryUtilsTest extends Specification {
         result == parentDN
 
         where:
-        actualDN                                                | parentDN
-        "OU=SomeNestedTeam,OU=SomeTeam,OU=Teams,DC=fingo,DC=pl" | "OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"
-        "OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"                   | "OU=Teams,DC=fingo,DC=pl"
-        "OU=Teams"                                              | ""
-        ""                                                      | ""
+        actualDN                                                         | parentDN
+        "OU=Some name with\\, comma,OU=SomeTeam,OU=Teams,DC=fingo,DC=pl" | "OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"
+        "OU=SomeNestedTeam,OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"          | "OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"
+        "OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"                            | "OU=Teams,DC=fingo,DC=pl"
+        "OU=Teams"                                                       | ""
+        ""                                                               | ""
     }
 
     def "getRelativeDN WHEN base matches, ends with or differs SHOULD return correct relative DN"() {
@@ -28,14 +29,14 @@ class ActiveDirectoryUtilsTest extends Specification {
         result == expectedRelativeDN
 
         where:
-        distinguishedName                                      | base                                 | expectedRelativeDN
-        "OU=SomeNestedTeam,OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"| "OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"| "OU=SomeNestedTeam"
-        "OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"                  | "OU=Teams,DC=fingo,DC=pl"            | "OU=SomeTeam"
-        "OU=Teams,DC=fingo,DC=pl"                              | "OU=Teams,DC=fingo,DC=pl"            | ""
-        "OU=RandomTeam,OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"    | "OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"| "OU=RandomTeam"
-        "OU=Teams,DC=fingo,DC=pl"                              | "OU=DifferentBase,DC=fingo,DC=pl"    | "OU=Teams,DC=fingo,DC=pl"
-        ""                                                     | ""                                   | ""
-        "OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"                  | ""                                   | "OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"
+        distinguishedName                                       | base                                  | expectedRelativeDN
+        "OU=SomeNestedTeam,OU=SomeTeam,OU=Teams,DC=fingo,DC=pl" | "OU=SomeTeam,OU=Teams,DC=fingo,DC=pl" | "OU=SomeNestedTeam"
+        "OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"                   | "OU=Teams,DC=fingo,DC=pl"             | "OU=SomeTeam"
+        "OU=Teams,DC=fingo,DC=pl"                               | "OU=Teams,DC=fingo,DC=pl"             | ""
+        "OU=RandomTeam,OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"     | "OU=SomeTeam,OU=Teams,DC=fingo,DC=pl" | "OU=RandomTeam"
+        "OU=Teams,DC=fingo,DC=pl"                               | "OU=DifferentBase,DC=fingo,DC=pl"     | "OU=Teams,DC=fingo,DC=pl"
+        ""                                                      | ""                                    | ""
+        "OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"                   | ""                                    | "OU=SomeTeam,OU=Teams,DC=fingo,DC=pl"
     }