Raise UnsupportedDnFormatError on multivalued RDNs

lib/gitlab/ldap/dn.rb

@@ -108,6 +108,7 @@ module Gitlab
               yield key.string.strip, value.string.rstrip
               key = StringIO.new
               value = StringIO.new;
+            when '+' then raise(UnsupportedDnFormatError, "Multivalued RDNs are not supported")
             else value << char
             end
           when :value_normal_escape then
@@ -133,6 +134,7 @@ module Gitlab
               yield key.string.strip, value.string # Don't strip trailing escaped space!
               key = StringIO.new
               value = StringIO.new;
+            when '+' then raise(UnsupportedDnFormatError, "Multivalued RDNs are not supported")
             else value << char
             end
           when :value_quoted then

spec/lib/gitlab/ldap/dn_spec.rb

@@ -16,8 +16,6 @@ describe Gitlab::LDAP::DN do
       'strips extraneous whitespace'                                                                 | 'uid     =John Smith ,  ou = People, dc=  example,dc =com'                                            | 'uid=john smith,ou=people,dc=example,dc=com'
       'strips extraneous whitespace for a DN with a single RDN'                                      | 'uid  =  John Smith'                                                                                  | 'uid=john smith'
       'unescapes non-reserved, non-special Unicode characters'                                       | 'uid   =  Sebasti\\c3\\a1n\\ C.\\20Smith\\   ,   ou=People (aka. \\22humans\\")  ,dc=example, dc=com' | 'uid=sebastián c. smith  \\ ,ou=people (aka. \\"humans\\"),dc=example,dc=com'
-      'strips extraneous whitespace without modifying the multivalued RDN'                           | 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com'              | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
-      'strips the space after the plus sign in the telephoneNumber'                                  | 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com'             | 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com'
       'downcases the whole string'                                                                   | 'UID=John Smith,ou=People,dc=example,dc=com'                                                          | 'uid=john smith,ou=people,dc=example,dc=com'
       'for a null DN (empty string), returns empty string and does not error'                        | ''                                                                                                    | ''
       'does not strip an escaped leading space in an attribute value'                                | 'uid=\\ John Smith,ou=People,dc=example,dc=com'                                                       | 'uid=\\ john smith,ou=people,dc=example,dc=com'
@@ -42,6 +40,36 @@ describe Gitlab::LDAP::DN do
       end
     end
 
+    context 'when we do not support the given DN format' do
+      context 'multivalued RDNs' do
+        context 'without extraneous whitespace' do
+          let(:given) { 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com' }
+
+          it 'raises UnsupportedDnFormatError' do
+            expect{ subject }.to raise_error(Gitlab::LDAP::UnsupportedDnFormatError)
+          end
+        end
+
+        context 'with extraneous whitespace' do
+          context 'around the phone number plus sign' do
+            let(:given) { 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com' }
+
+            it 'raises UnsupportedDnFormatError' do
+              expect{ subject }.to raise_error(Gitlab::LDAP::UnsupportedDnFormatError)
+            end
+          end
+
+          context 'not around the phone number plus sign' do
+            let(:given) { 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com' }
+
+            it 'raises UnsupportedDnFormatError' do
+              expect{ subject }.to raise_error(Gitlab::LDAP::UnsupportedDnFormatError)
+            end
+          end
+        end
+      end
+    end
+
     context 'when the given DN is malformed' do
       let(:given) { 'uid\\=john' }