From 5a79884977face714998ca3d32a75208a4edf76c Mon Sep 17 00:00:00 2001
From: Mark Cavage <mark.cavage@joyent.com>
Date: Thu, 31 Jan 2013 15:51:23 +0000
Subject: [PATCH] allow _ in search filters

---
 lib/filters/index.js | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/lib/filters/index.js b/lib/filters/index.js
index ab410ed..bcf5d36 100644
--- a/lib/filters/index.js
+++ b/lib/filters/index.js
@@ -115,8 +115,33 @@ function _buildFilterTree(expr) {
     tree.name = '';
     tree.value = '';
 
+
+    // This parses and enforces filter syntax, which is an AttributeDescription
+    // plus a filter operator, followed by (for ldapjs), anything.  Note
+    // that ldapjs additionally allows the '_' character in the AD, as many
+    // users rely on it, even though it's non-standard
+    //
+    // From 4.1.5 of RFC251
+    //
+    //  AttributeDescription ::= LDAPString
+    //
+    //  A value of AttributeDescription is based on the following BNF:
+    //
+    //    <AttributeDescription> ::= <AttributeType> [ ";" <options> ]
+    //
+    //    <options>  ::= <option> | <option> ";" <options>
+    //
+    //    <option>   ::= <opt-char> <opt-char>*
+    //
+    //    <opt-char> ::=  ASCII-equivalent letters, numbers and hyphen
+    //
+    // Examples of valid AttributeDescription:
+    //
+    //    cn
+    //    userCertificate;binary
+
     /* JSSTYLED */
-    if (!/[a-zA-Z0-9;\-]+[~><:]?=.+/.test(expr))
+    if (!/[a-zA-Z0-9;_\-]+[~><:]?=.+/.test(expr))
       throw new Error(expr + ' is invalid');
 
     if (expr.indexOf('~=') !== -1) {