From 07447246fed84329f7b1bc3e12c592cc9907c4a8 Mon Sep 17 00:00:00 2001
From: Becca Petrin <beccapetrin@posteo.net>
Date: Fri, 5 Oct 2018 09:19:02 -0700
Subject: [PATCH] add a check to prevent panics

---
 helper/ldaputil/client.go      | 4 ++++
 helper/ldaputil/client_test.go | 1 +
 2 files changed, 5 insertions(+)

diff --git a/helper/ldaputil/client.go b/helper/ldaputil/client.go
index 86804c146a09..130b17e92d6c 100644
--- a/helper/ldaputil/client.go
+++ b/helper/ldaputil/client.go
@@ -377,6 +377,10 @@ func (c *Client) GetLdapGroups(cfg *ConfigEntry, conn Connection, userDN string,
 
 // EscapeLDAPValue is exported because a plugin uses it outside this package.
 func EscapeLDAPValue(input string) string {
+	if input == "" {
+		return ""
+	}
+
 	// RFC4514 forbids un-escaped:
 	// - leading space or hash
 	// - trailing space
diff --git a/helper/ldaputil/client_test.go b/helper/ldaputil/client_test.go
index 629cc58e9895..fa06c2c40b94 100644
--- a/helper/ldaputil/client_test.go
+++ b/helper/ldaputil/client_test.go
@@ -11,6 +11,7 @@ func TestLDAPEscape(t *testing.T) {
 		"test,hel+lo": "test\\,hel\\+lo",
 		"test\\hello": "test\\\\hello",
 		"  test  ":    "\\  test \\ ",
+		"":            "",
 	}
 
 	for test, answer := range testcases {