Remove the dreaded DN regex, instead validating DNs using the newly defined `ldap-dn` schema format (which uses Net::LDAP::Util::canonical_dn() under the hood).
Result of a previous discussion [0]. [0] https://lists.proxmox.com/pipermail/pve-devel/2023-May/056839.html Signed-off-by: Christoph Heiss <c.he...@proxmox.com> --- Needs a bump of libpve-common-perl due to the new 'ldap-dn' schema format. src/PVE/Auth/LDAP.pm | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/src/PVE/Auth/LDAP.pm b/src/PVE/Auth/LDAP.pm index fc82a17..e0ead1b 100755 --- a/src/PVE/Auth/LDAP.pm +++ b/src/PVE/Auth/LDAP.pm @@ -10,9 +10,6 @@ use PVE::Tools; use base qw(PVE::Auth::Plugin); -my $dn_part_regex = qr!("[^"]+"|[^ ,+"/<>;=#][^,+"/<>;=]*[^ ,+"/<>;=]|[^ ,+"/<>;=#])!; -our $dn_regex = qr!\w+=${dn_part_regex}(,\s*\w+=${dn_part_regex})*!; - sub type { return 'ldap'; } @@ -22,7 +19,7 @@ sub properties { base_dn => { description => "LDAP base domain name", type => 'string', - pattern => $dn_regex, + format => 'ldap-dn', optional => 1, maxLength => 256, }, @@ -36,7 +33,7 @@ sub properties { bind_dn => { description => "LDAP bind domain name", type => 'string', - pattern => $dn_regex, + format => 'ldap-dn', optional => 1, maxLength => 256, }, @@ -94,7 +91,7 @@ sub properties { description => "LDAP base domain name for group sync. If not set, the" ." base_dn will be used.", type => 'string', - pattern => $dn_regex, + format => 'ldap-dn', optional => 1, maxLength => 256, }, -- 2.41.0 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
