Syncthing Version

Syncthing version: v1.23.7, AMD64 Docker Container

What Happened

This seems similar to #8899, but for the LDAP search filter.
Configuring an LDAP search filter without the %s placeholder results in a warning message in the log file and a corrupt search filter sent to the LDAP server. Logging in with LDAP fails. I could not find the search filter in the LDAP log files though, but that might be due to the behavior of my LDAP server when receiving a corrupt search filter.

If %s is used in LDAP search filter, everything works.

Does not work:

(memberOf=CN=Syncthing,CN=Users,DC=example,DC=com)

Message in Syncthing log reads

WARNING: LDAP Search: LDAP Result Code 201 "Filter Compile Error": ldap: finished compiling filter with extra at end: %!(EXTRA string=myUser)

Works:

(&(sAMAccountName=%s)(memberOf=CN=Syncthing,CN=Users,DC=example,DC=com))

What Is Expected

If %s is omitted from LDAP search filter, send it as configured without any processing.

Reproduction

• Configure an LDAP search filter without a %s placeholder
• Enable LDAP auth
• Login fails, find warning in Syncthing logs, possibly in LDAP logs depending on LDAP server