Java SearchControls.setReturningAttributes方法代碼示例

import javax.naming.directory.SearchControls; //導入方法依賴的package包/類
private static String dnFromUser(String username) throws NamingException {
    Properties props = new Properties();
    props.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
    props.put(Context.PROVIDER_URL, "ldap://ldap.example.com");
    props.put(Context.REFERRAL, "ignore");

    InitialDirContext context = new InitialDirContext(props);

    SearchControls ctrls = new SearchControls();
    ctrls.setReturningAttributes(new String[]{"givenName", "sn"});
    ctrls.setSearchScope(SearchControls.SUBTREE_SCOPE);

    NamingEnumeration<SearchResult> answers = context.search("dc=People,dc=example,dc=com", "(uid=" + username + ")", ctrls);
    SearchResult result = answers.next();

    return result.getNameInNamespace();
}
 

import javax.naming.directory.SearchControls; //導入方法依賴的package包/類
public void ldapInjectionSunApi(String input) throws NamingException {
    //Stub instances
    Properties props = new Properties();
    props.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
    props.put(Context.PROVIDER_URL, "ldap://ldap.example.com");
    props.put(Context.REFERRAL, "ignore");

    SearchControls ctrls = new SearchControls();
    ctrls.setReturningAttributes(new String[]{"givenName", "sn"});
    ctrls.setSearchScope(SearchControls.SUBTREE_SCOPE);

    //Two context instances mostly usable with sun specific API
    LdapCtx            context5 = null;
    EventDirContext    context6 = null; //LdapCtx is the only known class to implements to this interface

    NamingEnumeration<SearchResult> answers;
    answers = context5.search(new LdapName("dc=People,dc=example,dc=com"), "(uid=" + input + ")", ctrls);
    answers = context5.search(new LdapName("dc=People,dc=example,dc=com"), "(uid=" + input + ")", new Object[0], ctrls);
    answers = context5.search("dc=People,dc=example,dc=com", "(uid=" + input + ")", ctrls);
    answers = context5.search("dc=People,dc=example,dc=com", "(uid=" + input + ")", new Object[0], ctrls);

    answers = context6.search(new LdapName("dc=People,dc=example,dc=com"), "(uid=" + input + ")", ctrls);
    answers = context6.search(new LdapName("dc=People,dc=example,dc=com"), "(uid=" + input + ")", new Object[0], ctrls);
    answers = context6.search("dc=People,dc=example,dc=com", "(uid=" + input + ")", ctrls);
    answers = context6.search("dc=People,dc=example,dc=com", "(uid=" + input + ")", new Object[0], ctrls);
}
 

import javax.naming.directory.SearchControls; //導入方法依賴的package包/類
/**
 * @return null if there are zero results
 */
private NamingEnumeration<SearchResult> search(DirContext ctx, Name base, String[] returnAttributes, Filter filter,
	boolean recurse)
{
	SearchControls ctls = new SearchControls();
	ctls.setCountLimit(filter.getLimit());
	ctls.setReturningAttributes(returnAttributes);
	ctls.setSearchScope(recurse ? SearchControls.SUBTREE_SCOPE : SearchControls.ONELEVEL_SCOPE);

	try
	{
		// Search for objects using the filter
		String query = filter.toFilter();
		if( LOGGER.isDebugEnabled() )
		{
			LOGGER.debug("Query:" + query + " Base:" + base);
		}
		NamingEnumeration<SearchResult> ne = ctx.search(base, query, ctls);
		if( ne.hasMore() )
		{
			return ne;
		}
	}
	catch( PartialResultException pre )
	{
		LOGGER.info(pre);
	}
	catch( SizeLimitExceededException slee )
	{
		LOGGER.info(slee);
	}
	catch( Exception e )
	{
		LOGGER.warn(e);
	}

	return null;
}
 

import javax.naming.directory.SearchControls; //導入方法依賴的package包/類
private <T> List<T> searchByLimit(Properties properties, String baseDN,
        String filter, ILdapResultMapper<T> mapper, boolean checkAttribute,
        int searchLimit) throws NamingException {
    List<T> list = new ArrayList<T>();
    NamingEnumeration<SearchResult> namingEnum = null;

    DirContext ctx = getDirContext(properties);

    SearchControls ctls = new SearchControls();
    String[] attrIds = mapper.getAttributes();
    ctls.setReturningAttributes(attrIds);
    ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);
    ctls.setCountLimit(searchLimit);

    try {
        namingEnum = ctx.search(baseDN, escapeLDAPSearchFilter(filter),
                ctls);
        int count = 0;
        while (count++ < searchLimit && hasMoreEnum(namingEnum)) {
            SearchResult res = namingEnum.next();
            Attributes ldapAttributes = res.getAttributes();
            String[] values = new String[attrIds.length];
            for (int i = 0; i < values.length; i++) {
                Attribute ldapAttr = ldapAttributes
                        .get(escapeLDAPSearchFilter(attrIds[i]));
                if (checkAttribute && ldapAttr == null) {
                    NamingException e = new NamingException(
                            "Unknown LDAP attribute " + attrIds[i]);
                    throw e;
                }
                if (ldapAttr != null && ldapAttr.get() != null) {
                    values[i] = ldapAttr.get().toString();
                }
            }
            T t = mapper.map(values);
            if (t != null) {
                list.add(t);
            }
        }
    } finally {
        if (namingEnum != null) {
            try {
                namingEnum.close();
            } finally {
                closeContext(ctx);
            }
        }
        closeContext(ctx);
    }
    return list;
}
 

import javax.naming.directory.SearchControls; //導入方法依賴的package包/類
/**
 * Add roles to a user and search for other roles containing them themselves.
 * We search recursively with a limited depth.
 * By default the depth is 0, and we only use direct roles.
 * The search needs to use the distinguished role names,
 * but to return the role names.
 *
 * @param depth Recursion depth, starting at zero
 * @param context The directory context we are searching
 * @param recursiveMap The cumulative result map of role names and DNs.
 * @param recursiveSet The cumulative result set of role names.
 * @param groupName The role name to add to the list.
 * @param groupDName The distinguished name of the role.
 *
 * @exception NamingException if a directory server error occurs
 */
private void getRolesRecursive(int depth, DirContext context, Map<String, String> recursiveMap, Set<String> recursiveSet,
                                 String groupName, String groupDName) throws NamingException {
    if (containerLog.isTraceEnabled())
        containerLog.trace("Recursive search depth " + depth + " for group '" + groupDName + " (" + groupName + ")'");
    // Adding the given group to the result set if not already found
    if (!recursiveSet.contains(groupDName)) {
        recursiveSet.add(groupDName);
        recursiveMap.put(groupDName, groupName);
        if (depth >= roleRecursionLimit) {
            if (roleRecursionLimit > 0)
                containerLog.warn("Terminating recursive role search because of recursion limit " +
                                  roleRecursionLimit + ", results might be incomplete");
            return;
        }
        // Prepare the parameters for searching groups
        String filter = roleFormat.format(new String[] { groupDName });
        SearchControls controls = new SearchControls();
        controls.setSearchScope(roleSubtree ? SearchControls.SUBTREE_SCOPE : SearchControls.ONELEVEL_SCOPE);
        controls.setReturningAttributes(new String[] { roleName });
        if (containerLog.isTraceEnabled()) {
            containerLog.trace("Recursive search in role base '" + roleBase + "' for attribute '" + roleName + "'" +
                               " with filter expression '" + filter + "'");
        }
        // Searching groups that assign the given group
        NamingEnumeration results = context.search(roleBase, filter, controls);
        if (results != null) {
            // Iterate over the resulting groups
            try {
                while (results.hasMore()) {
                    SearchResult result = (SearchResult) results.next();
                    Attributes attrs = result.getAttributes();
                    if (attrs == null)
                        continue;
                    String dname = getDistinguishedName(context, roleBase, result);
                    String name = getAttributeValue(roleName, attrs);
                    if (name != null && dname != null) {
                       getRolesRecursive(depth+1, context, recursiveMap, recursiveSet, name, dname);
                    }
                }
            } catch (PartialResultException ex) {
                if (!adCompat)
                    throw ex;
            }
        }
    }
}
 

import javax.naming.directory.SearchControls; //導入方法依賴的package包/類
public static void moreLdapInjections(String input) throws NamingException {
    //Stub instances
    Properties props = new Properties();
    props.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
    props.put(Context.PROVIDER_URL, "ldap://ldap.example.com");
    props.put(Context.REFERRAL, "ignore");

    SearchControls ctrls = new SearchControls();
    ctrls.setReturningAttributes(new String[]{"givenName", "sn"});
    ctrls.setSearchScope(SearchControls.SUBTREE_SCOPE);

    //Various context instance store in various type (class or interface)
    DirContext         context1 = new InitialDirContext(props);
    InitialDirContext  context2 = new InitialDirContext(props);
    InitialLdapContext context3 = new InitialLdapContext();
    LdapContext        context4 = new InitialLdapContext();

    NamingEnumeration<SearchResult> answers;
    answers = context1.search(new LdapName("dc=People,dc=example,dc=com"), "(uid=" + input + ")", ctrls);
    answers = context1.search(new LdapName("dc=People,dc=example,dc=com"), "(uid=" + input + ")", new Object[0], ctrls);
    answers = context1.search("dc=People,dc=example,dc=com", "(uid=" + input + ")", ctrls);
    answers = context1.search("dc=People,dc=example,dc=com", "(uid=" + input + ")", new Object[0], ctrls);

    answers = context2.search(new LdapName("dc=People,dc=example,dc=com"), "(uid=" + input + ")", ctrls);
    answers = context2.search(new LdapName("dc=People,dc=example,dc=com"), "(uid=" + input + ")", new Object[0], ctrls);
    answers = context2.search("dc=People,dc=example,dc=com", "(uid=" + input + ")", ctrls);
    answers = context2.search("dc=People,dc=example,dc=com", "(uid=" + input + ")", new Object[0], ctrls);

    answers = context3.search(new LdapName("dc=People,dc=example,dc=com"), "(uid=" + input + ")", ctrls);
    answers = context3.search(new LdapName("dc=People,dc=example,dc=com"), "(uid=" + input + ")", new Object[0], ctrls);
    answers = context3.search("dc=People,dc=example,dc=com", "(uid=" + input + ")", ctrls);
    answers = context3.search("dc=People,dc=example,dc=com", "(uid=" + input + ")", new Object[0], ctrls);

    answers = context4.search(new LdapName("dc=People,dc=example,dc=com"), "(uid=" + input + ")", ctrls);
    answers = context4.search(new LdapName("dc=People,dc=example,dc=com"), "(uid=" + input + ")", new Object[0], ctrls);
    answers = context4.search("dc=People,dc=example,dc=com", "(uid=" + input + ")", ctrls);
    answers = context4.search("dc=People,dc=example,dc=com", "(uid=" + input + ")", new Object[0], ctrls);


    //False positive
    answers = context1.search(new LdapName("dc=People,dc=example,dc=com"), "(uid=bob)", ctrls);
    answers = context1.search(new LdapName("dc=People,dc=example,dc=com"), "(uid=bob)", new Object[0], ctrls);
    answers = context1.search("dc=People,dc=example,dc=com", "(uid=bob)", ctrls);
    answers = context1.search("dc=People,dc=example,dc=com", "(uid=bob)", new Object[0], ctrls);
}