Missing validation for blank bind rule in ACI

[myandrews]

We use OpenDJ 5.1.0 and one of our tests is failed for decoding ACI containing blank bind rule.
Problem ACI is (version 3.0; acl "C"; allow (search)( ) (userdn="ldap:///self"); )

Error:

java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    at java.base/jdk.internal.util.Preconditions$1.apply(Preconditions.java:55)
    at java.base/jdk.internal.util.Preconditions$1.apply(Preconditions.java:52)
    at java.base/jdk.internal.util.Preconditions$4.apply(Preconditions.java:213)
    at java.base/jdk.internal.util.Preconditions$4.apply(Preconditions.java:210)
    at java.base/jdk.internal.util.Preconditions.outOfBounds(Preconditions.java:98)
    at java.base/jdk.internal.util.Preconditions.outOfBoundsCheckIndex(Preconditions.java:106)
    at java.base/jdk.internal.util.Preconditions.checkIndex(Preconditions.java:302)
    at java.base/java.lang.String.checkIndex(String.java:4822)
    at java.base/java.lang.StringLatin1.charAt(StringLatin1.java:46)
    at java.base/java.lang.String.charAt(String.java:1544)
    at org.opends.server.authorization.dseecompat.BindRule.decode(BindRule.java:154)
    at org.opends.server.authorization.dseecompat.BindRule.decode(BindRule.java:179)
    at org.opends.server.authorization.dseecompat.PermBindRulePair.<init>(PermBindRulePair.java:37)
    at org.opends.server.authorization.dseecompat.PermBindRulePair.decode(PermBindRulePair.java:50)
    at org.opends.server.authorization.dseecompat.AciBody.decode(AciBody.java:161)
    at org.opends.server.authorization.dseecompat.Aci.decode(Aci.java:276)

Root cause is in BindRule#decode, I suppose to replace check for input length by input.isBlank().

Test to reproduce the probem:

String input = "(version 3.0; acl \"C\"; allow (search)(          ) (userdn=\"ldap:///self\"); )";
ByteSequence aciByteString = ByteString.valueOfUtf8(input);
Aci.decode(aciByteString, DN.rootDN());

[vharseko]

Hi @myandrews, thanks for the detailed report and the reproducer — it made the root cause easy to pin down.

The fix is in PR #715. BindRule.decode was checking the input length before trimming, so an all-whitespace bind rule like ( ) slipped past the empty-input guard and then hit charAt(0) on the trimmed-empty string. The fix trims first and treats a blank bind rule as empty, so the malformed ACI is now rejected with a clean AciException instead of the StringIndexOutOfBoundsException.

Your exact reproducer is now covered by a unit test (AciBodyTest.decodeBlankBindRuleThrowsAciException).

Could you verify on your side that this resolves the failing test — ideally by building from the PR branch (vharseko:features/aci-blank-bindrule) and re-running your case? If your ACI is expected to be valid rather than rejected, please let us know, as the current fix treats a blank bind rule as a syntax error. Thanks!

[myandrews]

Hi @vharseko . I applied patch from your PR to our branch and ran tests. Everything works fine. Thanks!