Patched code sample

import re

def escape_dn_chars_vulnerable(value):
    """
    Represents the vulnerable behavior in python-ldap < 3.4.5.
    This function incorrectly escapes the NUL byte ('\x00').
    """
    # Simplified escaping for other common characters for context.
    # The actual library implementation is more comprehensive.
    value = re.sub(r'([,\\+<>;\"=#])', r'\\\1', value)

    # CVE-2025-61912: Incorrectly escapes NUL as a backslash
    # followed by a literal NUL byte. This can cause C-based
    # string parsers to fail, leading to a client-side DoS.
    return value.replace('\x00', '\\\x00')

def escape_dn_chars_fixed(value):
    """
    Represents the fixed behavior in python-ldap >= 3.4.5.
    This function correctly escapes the NUL byte per RFC-4514.
    """
    # Simplified escaping for other common characters for context.
    value = re.sub(r'([,\\+<>;\"=#])', r'\\\1', value)

    # THE FIX: Correctly escape NUL as a backslash followed by "00".
    # This produces a valid string that can be safely processed.
    return value.replace('\x00', '\\00')

# --- Demonstration ---

# An example of untrusted input containing a NUL byte.
untrusted_input = "cn=test\x00user,ou=people"

# 1. How the vulnerable version processed the input.
# The repr() output shows the problematic literal '\x00' remains.
vulnerable_output = escape_dn_chars_vulnerable(untrusted_input)

# 2. How the fixed version processes the input.
# The repr() output shows the correct RFC-4514 escaping '\\00'.
fixed_output = escape_dn_chars_fixed(untrusted_input)


# Print results to show the difference.
print("--- Demonstration of the fix for CVE-2025-61912 ---")
print(f"Original Untrusted Input: {untrusted_input!r}")
print("-" * 55)
print("Vulnerable Output (< 3.4.5):")
print(f"  - Result: {vulnerable_output!r}")
print(f"  - Contains literal NUL byte: {'\\x00' in vulnerable_output}")
print("\nFixed Output (>= 3.4.5):")
print(f"  - Result: {fixed_output!r}")
print(f"  - Contains literal NUL byte: {'\\x00' in fixed_output}")