Skip to content

Commit 1bfb466

Browse files
jzheauxjzheaux
committed
Polish toLower/UpperCase Usage
Apply the common security hardening technique of specifying Locale when calling toLowerCase and toUpperCase Closes gh-965
1 parent ec09768 commit 1bfb466

File tree

8 files changed

+58
-47
lines changed

8 files changed

+58
-47
lines changed

‎core/src/main/java/org/springframework/ldap/core/LdapRdnComponent.java‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -15,16 +15,18 @@
1515
*/
1616
package org.springframework.ldap.core;
1717

18+
import java.io.Serializable;
19+
import java.net.URI;
20+
import java.net.URISyntaxException;
21+
import java.util.Locale;
22+
1823
import org.slf4j.Logger;
1924
import org.slf4j.LoggerFactory;
25+
2026
import org.springframework.ldap.support.LdapEncoder;
2127
import org.springframework.util.Assert;
2228
import org.springframework.util.StringUtils;
2329

24-
import java.io.Serializable;
25-
import java.net.URI;
26-
import java.net.URISyntaxException;
27-
2830
/**
2931
* Represents part of an LdapRdn. As specified in RFC2253 an LdapRdn may be
3032
* composed of several attributes, separated by "+". An
@@ -74,9 +76,9 @@ public LdapRdnComponent(String key, String value, boolean decodeValue) {
7476

7577
String caseFold = System.getProperty(DistinguishedName.KEY_CASE_FOLD_PROPERTY);
7678
if (!StringUtils.hasText(caseFold) || caseFold.equals(DistinguishedName.KEY_CASE_FOLD_LOWER)) {
77-
this.key = key.toLowerCase();
79+
this.key = key.toLowerCase(Locale.ROOT);
7880
} else if (caseFold.equals(DistinguishedName.KEY_CASE_FOLD_UPPER)) {
79-
this.key = key.toUpperCase();
81+
this.key = key.toUpperCase(Locale.ROOT);
8082
} else if (caseFold.equals(DistinguishedName.KEY_CASE_FOLD_NONE)) {
8183
this.key = key;
8284
} else {
@@ -85,7 +87,7 @@ public LdapRdnComponent(String key, String value, boolean decodeValue) {
8587
+ "; expected \"" + DistinguishedName.KEY_CASE_FOLD_LOWER + "\", \""
8688
+ DistinguishedName.KEY_CASE_FOLD_UPPER + "\", or \""
8789
+ DistinguishedName.KEY_CASE_FOLD_NONE + "\"");
88-
this.key = key.toLowerCase();
90+
this.key = key.toLowerCase(Locale.ROOT);
8991
}
9092
if (decodeValue) {
9193
this.value = LdapEncoder.nameDecode(value);
@@ -191,7 +193,7 @@ public String encodeUrl() {
191193
* @see java.lang.Object#hashCode()
192194
*/
193195
public int hashCode() {
194-
return key.toUpperCase().hashCode() ^ value.toUpperCase().hashCode();
196+
return key.toUpperCase(Locale.ROOT).hashCode() ^ value.toUpperCase(Locale.ROOT).hashCode();
195197
}
196198

197199
/*
@@ -227,9 +229,9 @@ public int compareTo(Object obj) {
227229

228230
// It's safe to compare directly against key and value,
229231
// because they are validated not to be null on instance creation.
230-
int keyCompare = this.key.toLowerCase().compareTo(that.key.toLowerCase());
232+
int keyCompare = this.key.toLowerCase(Locale.ROOT).compareTo(that.key.toLowerCase(Locale.ROOT));
231233
if(keyCompare == 0) {
232-
return this.value.toLowerCase().compareTo(that.value.toLowerCase());
234+
return this.value.toLowerCase(Locale.ROOT).compareTo(that.value.toLowerCase(Locale.ROOT));
233235
} else {
234236
return keyCompare;
235237
}

‎core/src/main/java/org/springframework/ldap/core/NameAwareAttributes.java‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,15 @@
1616

1717
package org.springframework.ldap.core;
1818

19-
import org.springframework.util.Assert;
19+
import java.util.HashMap;
20+
import java.util.Locale;
21+
import java.util.Map;
2022

2123
import javax.naming.NamingEnumeration;
2224
import javax.naming.directory.Attribute;
2325
import javax.naming.directory.Attributes;
24-
import java.util.HashMap;
25-
import java.util.Map;
26+
27+
import org.springframework.util.Assert;
2628

2729
/**
2830
* Used internally to help DirContextAdapter properly handle Names as values.
@@ -65,7 +67,7 @@ public int size() {
6567
@Override
6668
public NameAwareAttribute get(String attrID) {
6769
Assert.hasLength(attrID, "Attribute ID must not be empty");
68-
return attributes.get(attrID.toLowerCase());
70+
return attributes.get(attrID.toLowerCase(Locale.ROOT));
6971
}
7072

7173
@Override
@@ -82,7 +84,7 @@ public NamingEnumeration<String> getIDs() {
8284
public Attribute put(String attrID, Object val) {
8385
Assert.hasLength(attrID, "Attribute ID must not be empty");
8486
NameAwareAttribute newAttribute = new NameAwareAttribute(attrID, val);
85-
attributes.put(attrID.toLowerCase(), newAttribute);
87+
attributes.put(attrID.toLowerCase(Locale.ROOT), newAttribute);
8688

8789
return newAttribute;
8890
}
@@ -91,15 +93,15 @@ public Attribute put(String attrID, Object val) {
9193
public Attribute put(Attribute attr) {
9294
Assert.notNull(attr, "Attribute must not be null");
9395
NameAwareAttribute newAttribute = new NameAwareAttribute(attr);
94-
attributes.put(attr.getID().toLowerCase(), newAttribute);
96+
attributes.put(attr.getID().toLowerCase(Locale.ROOT), newAttribute);
9597

9698
return newAttribute;
9799
}
98100

99101
@Override
100102
public Attribute remove(String attrID) {
101103
Assert.hasLength(attrID, "Attribute ID must not be empty");
102-
return attributes.remove(attrID.toLowerCase());
104+
return attributes.remove(attrID.toLowerCase(Locale.ROOT));
103105
}
104106

105107
@Override

‎core/src/main/java/org/springframework/ldap/odm/core/impl/CaseIgnoreString.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.ldap.odm.core.impl;
1818

19+
import java.util.Locale;
20+
1921
import org.springframework.util.Assert;
2022

2123
// A case independent String wrapper.
@@ -26,7 +28,7 @@
2628
public CaseIgnoreString(String string) {
2729
Assert.notNull(string, "string must not be null");
2830
this.string = string;
29-
hashCode = string.toUpperCase().hashCode();
31+
hashCode = string.toUpperCase(Locale.ROOT).hashCode();
3032
}
3133

3234
public boolean equals(Object other) {

‎core/src/main/java/org/springframework/ldap/support/LdapEncoder.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,10 @@
1717
package org.springframework.ldap.support;
1818

1919
import java.util.Base64;
20+
import java.util.Locale;
2021

2122
import org.springframework.ldap.BadLdapGrammarException;
2223
import org.springframework.util.Assert;
23-
import org.springframework.util.ClassUtils;
2424

2525

2626
/**
@@ -82,7 +82,7 @@ private LdapEncoder() {
8282

8383
protected static String toTwoCharHex(char c) {
8484

85-
String raw = Integer.toHexString(c).toUpperCase();
85+
String raw = Integer.toHexString(c).toUpperCase(Locale.ROOT);
8686

8787
if (raw.length() > 1) {
8888
return raw;

‎odm/src/main/java/org/springframework/ldap/odm/tools/SchemaReader.java‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,17 @@
1616

1717
package org.springframework.ldap.odm.tools;
1818

19-
import org.springframework.ldap.odm.tools.SyntaxToJavaClass.ClassInfo;
19+
import java.util.HashSet;
20+
import java.util.Locale;
21+
import java.util.Set;
2022

2123
import javax.naming.NamingEnumeration;
2224
import javax.naming.NamingException;
2325
import javax.naming.directory.Attribute;
2426
import javax.naming.directory.Attributes;
2527
import javax.naming.directory.DirContext;
26-
import java.util.HashSet;
27-
import java.util.Set;
28+
29+
import org.springframework.ldap.odm.tools.SyntaxToJavaClass.ClassInfo;
2830

2931
// Processes LDAP Schema
3032
/* package */ final class SchemaReader {
@@ -148,7 +150,7 @@ private void createObjectClass(Set<String> objectClasses, DirContext schemaConte
148150
Attribute currentAttribute = valuesEnumeration.nextElement();
149151

150152
// Get the attribute name and lower case it (as this is all case indep)
151-
String currentId = currentAttribute.getID().toUpperCase();
153+
String currentId = currentAttribute.getID().toUpperCase(Locale.ROOT);
152154

153155
// Is this a MUST, MAY or SUP attribute
154156
SchemaAttributeType type = getSchemaAttributeType(currentId);
@@ -160,7 +162,7 @@ private void createObjectClass(Set<String> objectClasses, DirContext schemaConte
160162
switch (type) {
161163
case SUP:
162164
// Its a super class
163-
String lowerCased=currentValue.toLowerCase();
165+
String lowerCased=currentValue.toLowerCase(Locale.ROOT);
164166
if (!schema.getObjectClass().contains(lowerCased)) {
165167
supList.add(lowerCased);
166168
}

‎odm/src/main/java/org/springframework/ldap/odm/tools/SchemaToJava.java‎

Lines changed: 20 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -16,23 +16,6 @@
1616

1717
package org.springframework.ldap.odm.tools;
1818

19-
import freemarker.template.Configuration;
20-
import freemarker.template.DefaultObjectWrapper;
21-
import freemarker.template.Template;
22-
import freemarker.template.TemplateException;
23-
import org.apache.commons.cli.CommandLine;
24-
import org.apache.commons.cli.CommandLineParser;
25-
import org.apache.commons.cli.HelpFormatter;
26-
import org.apache.commons.cli.Options;
27-
import org.apache.commons.cli.ParseException;
28-
import org.apache.commons.cli.PosixParser;
29-
import org.slf4j.Logger;
30-
import org.slf4j.LoggerFactory;
31-
32-
import javax.naming.Context;
33-
import javax.naming.NamingException;
34-
import javax.naming.directory.DirContext;
35-
import javax.naming.directory.InitialDirContext;
3619
import java.io.BufferedReader;
3720
import java.io.File;
3821
import java.io.FileOutputStream;
@@ -44,11 +27,30 @@
4427
import java.util.HashMap;
4528
import java.util.HashSet;
4629
import java.util.Hashtable;
30+
import java.util.Locale;
4731
import java.util.Map;
4832
import java.util.Set;
4933
import java.util.regex.Matcher;
5034
import java.util.regex.Pattern;
5135

36+
import javax.naming.Context;
37+
import javax.naming.NamingException;
38+
import javax.naming.directory.DirContext;
39+
import javax.naming.directory.InitialDirContext;
40+
41+
import freemarker.template.Configuration;
42+
import freemarker.template.DefaultObjectWrapper;
43+
import freemarker.template.Template;
44+
import freemarker.template.TemplateException;
45+
import org.apache.commons.cli.CommandLine;
46+
import org.apache.commons.cli.CommandLineParser;
47+
import org.apache.commons.cli.HelpFormatter;
48+
import org.apache.commons.cli.Options;
49+
import org.apache.commons.cli.ParseException;
50+
import org.apache.commons.cli.PosixParser;
51+
import org.slf4j.Logger;
52+
import org.slf4j.LoggerFactory;
53+
5254
/**
5355
* This tool creates a Java class representation of a set of LDAP object classes for use
5456
* with {@link org.springframework.ldap.odm.core.OdmManager}.
@@ -328,7 +330,7 @@ private static Set<String> parseObjectClassesFlag(String objectClassesFlag) {
328330

329331
for (String objectClassFlag : objectClassesFlag.split(",")) {
330332
if (objectClassFlag.length() > 0) {
331-
objectClasses.add(objectClassFlag.toLowerCase().trim());
333+
objectClasses.add(objectClassFlag.toLowerCase(Locale.ROOT).trim());
332334
}
333335
}
334336

‎samples/user-admin/src/main/webapp/resources/jquery/jquery.min.js‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎test/integration-tests-ad/src/test/java/org/springframework/ldap/itest/ad/IncrementalAttributeMapperITest.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939
import javax.naming.directory.ModificationItem;
4040
import java.io.UnsupportedEncodingException;
4141
import java.util.List;
42+
import java.util.Locale;
4243

4344
import static org.assertj.core.api.Assertions.assertThat;
4445
import static org.assertj.core.api.Assertions.fail;
@@ -107,7 +108,7 @@ private void createUser(String username) throws UnsupportedEncodingException {
107108
ctx.setAttributeValue("userPrincipalName", username + "@example.com");
108109
ctx.setAttributeValue("cn", username);
109110
ctx.setAttributeValue("description", "Dummy user");
110-
ctx.setAttributeValue("sAMAccountName", username.toUpperCase() + "." + username.toUpperCase());
111+
ctx.setAttributeValue("sAMAccountName", username.toUpperCase(Locale.ENGLISH) + "." + username.toUpperCase(Locale.ENGLISH));
111112
ctx.setAttributeValue("userAccountControl", "512");
112113

113114
String newQuotedPassword = "\"" + DEFAULT_PASSWORD + "\"";

0 commit comments

Comments
 (0)