fix: security and code quality improvements

[guimard]

Summary

• Fix LDAP injection vulnerabilities in organization.ts, groups.ts, and ldapFlat.ts by using escapeLdapFilter() for user-supplied query parameters
• Mask unauthorized tokens in logs to prevent credential exposure (token.ts)
• Extract duplicated regex caching utilities (getCompiledRegex, escapeRegex) from groups.ts and ldapFlat.ts into shared utils.ts
• Add .catch() handlers to fire-and-forget hook calls in ldapActions.ts to prevent silent failures
• Replace unbounded Map with LRUCache for attrSignatureCache to prevent memory leaks

Security fixes

LDAP Injection Prevention (Critical)

User-supplied query parameters were being directly interpolated into LDAP filters, allowing potential injection attacks:

Before:

filter: `(&(objectClass=organizationalUnit)(|(ou=*${query}*)(description=*${query}*)))`

After:

const escapedQuery = escapeLdapFilter(query);
filter: `(&(objectClass=organizationalUnit)(|(ou=*${escapedQuery}*)(description=*${escapedQuery}*)))`

Token Masking in Logs

Unauthorized tokens were logged in full, potentially exposing valid tokens:

Before:

this.logger.warn(`Unauthorized token: ${token}`);

After:

const maskedToken = token.length > 8 ? `${token.substring(0, 8)}...` : '***';
this.logger.warn(`Unauthorized token: ${maskedToken}`);

Code quality improvements

• Shared regex caching utilities in utils.ts reduce code duplication
• Hook error handling prevents silent failures
• Bounded LRU cache prevents memory leaks

Test plan

• Build passes (npm run build:dev)
• Run existing tests
• Manual testing of search endpoints with special characters

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR implements security fixes for LDAP injection vulnerabilities and several code quality improvements. The changes add LDAP filter escaping, mask unauthorized tokens in logs, extract duplicated regex utilities, add error handling to hooks, and replace an unbounded Map with an LRU cache.

Changes:

• Add escapeLdapFilter() function and apply it to user-supplied query parameters in LDAP searches
• Mask unauthorized tokens in authentication logs to prevent credential exposure
• Extract regex caching utilities (getCompiledRegex, escapeRegex) from class instances to shared utils
• Add .catch() handlers to fire-and-forget hook calls for better error visibility
• Replace unbounded attrSignatureCache Map with bounded LRUCache to prevent memory leaks

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/plugins/ldap/organization.ts	Adds LDAP filter escaping for search queries to prevent injection attacks
src/plugins/ldap/groups.ts	Applies LDAP filter escaping and removes duplicate regex utilities
src/plugins/auth/token.ts	Masks unauthorized tokens in logs to prevent credential exposure
src/lib/utils.ts	Adds shared regex caching utilities and LDAP escaping functions
src/lib/ldapActions.ts	Replaces unbounded Map with LRU cache and adds hook error handlers
src/abstract/ldapFlat.ts	Applies LDAP filter escaping and removes duplicate regex utilities

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The new regex caching utility functions (getCompiledRegex and escapeRegex) lack test coverage. While these are lower risk than security functions, they are shared across multiple plugins and should have unit tests to verify:

1. Proper caching behavior (returns same RegExp instance for same pattern)
2. Correct handling of flags parameter
3. Proper escaping of all special regex characters in escapeRegex

Consider adding tests for these utility functions in a test file like test/lib/utils.test.ts.