fix: escape ~ so RFC 4515 assertion values stay usable

[janiussyafiq]

RFC 4515 UTF1SUBSET (%x5D-7F) includes ~ (0x7e), so admin~ is a legal assertion value and a legal directory username.

The grammar excludes ~ from UTF8_FILTERED_CHARACTER so that ~= can be read as the approx operator, and the Cmt that hands a raw ~ back to the value only fires away from the end of the filter string. A leading or trailing ~ therefore failed to compile, so such a user could not be searched for.

This escapes it as \7e. The compiler un-escapes that back to ~, so the on-wire assertion value is unchanged, and (cn~=admin) still parses as approx.

Reported downstream on apache/apisix#13762.

Summary by CodeRabbit

• Bug Fixes

  • Improved LDAP filter handling for tilde characters (~), including leading, trailing, embedded, repeated, and standalone tildes.
  • Preserved the expected approximate-match behavior for the ~= operator.
  • Added hexadecimal escaping to ensure filters compile correctly and values round-trip accurately.

• Tests

  • Added coverage for tilde escaping and LDAP filter parsing across common edge cases.

[coderabbitai]

📝 Walkthrough

Walkthrough

The LDAP filter escape function now encodes ~ as \7e. Tests verify exact round-tripping for multiple tilde positions and preserve ~= approximate-match parsing.

Changes

Tilde escaping

Layer / File(s)	Summary
Escape tildes and validate round trips lib/resty/ldap/filter.lua, t/filter.t	_M.escape encodes ~ as \7e. Integration tests cover leading, trailing, embedded, repeated, and standalone tildes, while confirming that ~= remains an approximate-match operator.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• api7/lua-resty-ldap#36: Both changes update LDAP filter escaping and related tests.

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
E2e Test Quality Review	⚠️ Warning	TEST 8 only runs filter.escape/compile in an HTTP handler; it does not bind, call LDAP search, or verify a real entry, so it misses the required full E2E flow.	Add an OpenLDAP-backed test with a fixture user whose assertion value contains '~'; build the escaped filter, call client:search, and assert the returned entry and value, while retaining the edge-case unit checks.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Check	✅ Passed	The change only adds safe LDAP ~ escaping and round-trip tests; review found no new logging, persistence, authorization, ownership, TLS, isolation, or secret-reference behavior.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: escaping ~ in LDAP assertion values.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}