Malformed ldap search filters

[martinvanhensbergen]

Hi all,

we have noticed that in some cases, the reported LDAP search filter parsed from traffic is malformed. It seems to occur in the case that an AND or OR clause is followed by only one subnode. In those cases, we see that the filter misses a closing parenthesis ')'.

We are trying to isolate a pcap that has this to test but we thought we'd report it now as this symptom might also be analyzable through code inspection.

Should we have an isolated pcap that we can share, we will add it to the ticket.

Thanks!

[bbannier]

Thank you for the report @martinvanhensbergen. I can confirm that I see this issue in an artificial test case I added over in #22,

analyzer.functions ...
  > spicyc -j -d -L ${DIST}/analyzer %INPUT
... analyzer.functions failed
  % 'spicyc -j -d -L ${DIST}/analyzer <..>/tests/.tmp/analyzer.functions/functions.spicy' failed unexpectedly (exit code 1)
  % cat .stderr
  uncaught exception hilti::rt::AssertionFailure: (|(foo=*) (<..>/tests/.tmp/analyzer.functions/functions.spicy:113:5)

1 of 1 test failed