Re: [scim] Fwd: Escape search filter values

[Phil Hunt <[e-mail]>]

Mark

You are correct. Per sec 3.1, SCIM uses RFC7159/JSON for protocol payload messages as well as resources. 

Iow. Escape as specified in json. 

Phil

> On Nov 5, 2018, at 12:50 AM, Mark Dobrinic <[e-mail]> wrote:
> 
> Hi guys, 
> 
> have posted this question a month ago and didn't get a follow up. 
> Anybody has thoughts on it?
> 
> Thanks,
> 
> Mark
> 
> 
> -------- Forwarded Message --------
> Subject:	Escape search filter values
> Date:	Wed, 3 Oct 2018 17:37:07 +0200
> From:	Mark Dobrinic <[e-mail]>
> To:	[e-mail]
> 
> 
> Hi scim,
> 
> I've got a question on how to escape values that are part of the search
> filter query in scim 2.
> 
> For example, when sending out a search request for a user with a
> password, we're posting a JSON-message like this to our SCIM server:
> 
> {
>     "schemas": [
>         "urn:ietf:params:scim:api:messages:2.0:SearchRequest"
>     ],
>     "filter": "userName eq \"teddie\" and password eq "\secret\""
> }
> 
> But when the password contains control characters, like a double-quote
> (") or backslash (\), what should we send to the other end?
> 
> For now, we've been following the JSON approach, and are JSON-escaping
> the values inside the filter, such that when the password would be
> 'sec"ret', the JSON-message as it would be sent over becomes:
> 
> {
>     "schemas": [
>         "urn:ietf:params:scim:api:messages:2.0:SearchRequest"
>     ],
>     "filter": "userName eq \"teddie\" and password eq "\sec\\\"ret\""
> }
> 
> .... but I could not find out how to deal with this in the spec.
> 
> What do you think is the right thing to do here?
> 
> 
> -- 
> Regards,
> 
> Mark Dobrinic
> Software Engineer and Identity Specialist
> Curity AB
> 
> [e-mail]
> www.curity.io
> 
> _______________________________________________
> scim mailing list
> [e-mail]
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_scim&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=yuuDrNYVFRE1h4L9M7aHG0iY0D9sKoCorF5SKqb_du0&s=QOewzWBRy4HUgd1QL4mtSXaUd_2SaGPHnZxOuwpIl1I&e=