What additional validation do you want? It actually does valid the filter but things that look like bad filters are actually valid LDAP filters (like cn=).

Some validation is already done but LDAP filters can be rather liberal. We may be able to add on things like there need to be both name/value when using =, things like that.

Permissions V2 feature worked on in scope of #3566 validates the filter by doing a test LDAP search with it.

This is fixed already fixed in effort for #3566:

# ipa permission-mod testgroup --filter="broken filter"
ipa: ERROR: invalid 'ipapermtargetfilter': Bad search filter
# ipa permission-mod testgroup --filter="(cn=broken filter)"
-------------------------------
Modified permission "testgroup"
-------------------------------
...

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1108237