Immediate children should only have one RDN separator past the parent…

… length without NORMALIZED_ESC_BYTE+NORMALIZED_RDN_SEPARATOR
OpenIdentityPlatform · Oct 29, 2024 · bbfbcae · bbfbcae
1 parent 10ad784
commit bbfbcae
Showing 1 changed file with 13 additions and 4 deletions.
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/DnKeyFormat.java b/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/DnKeyFormat.java
@@ -120,18 +120,27 @@ static ByteStringBuilder afterLastChildOf(final ByteSequence key)
   static boolean isChild(ByteSequence parent, ByteSequence child)
   {
     if (child.length() <= parent.length()
-        || child.byteAt(parent.length()) != NORMALIZED_RDN_SEPARATOR
-        || !child.startsWith(parent))
+            || child.byteAt(parent.length()) != NORMALIZED_RDN_SEPARATOR
+            || !child.startsWith(parent))
     {
       return false;
     }
+    // Immediate children should only have one RDN separator past the parent length
+    boolean childSeparatorDetected = false;
     for (int i = parent.length() ; i < child.length(); i++)
     {
       if (child.byteAt(i) == NORMALIZED_RDN_SEPARATOR)
       {
-        return true;
+        if (childSeparatorDetected)
+        {
+          if (child.byteAt(i-1)==NORMALIZED_ESC_BYTE) {
+            continue;
+          }
+          return false;
+        }
+        childSeparatorDetected = true;
       }
     }
-    return false;
+    return childSeparatorDetected;
   }
 }