LDAP Injection Prevention Cheat Sheet - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T14:16:04Z

Point to the official site

Thunder-Son: Migration to GitHub

2019-02-14T13:01:45Z

Migration to GitHub

Jmanico: /* Other Cheatsheets */

2017-09-11T06:08:44Z

‎Other Cheatsheets

Jmanico: /* Authors and Primary Editors */

2017-03-10T19:18:24Z

‎Authors and Primary Editors

Jmanico: /* Defense Option 1: Escape all variables using the right LDAP encoding function */

2017-03-10T06:03:52Z

‎Defense Option 1: Escape all variables using the right LDAP encoding function

Jmanico: /* Defense Option 1: Escape all variables using the right LDAP encoding function */

2017-03-10T06:03:15Z

‎Defense Option 1: Escape all variables using the right LDAP encoding function

Jmanico: added more beef on escaping

2017-03-10T06:02:28Z

added more beef on escaping

Jmanico: adding github esapi code back in

2016-12-09T16:23:38Z

adding github esapi code back in

Jmanico: removing dead link. Need to add this back in at a later date with accurate link.

2016-12-07T07:23:20Z

removing dead link. Need to add this back in at a later date with accurate link.

Jmanico: /* White List Input Validation */

2015-10-29T11:43:57Z

‎White List Input Validation

← Older revision		Revision as of 14:16, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	Please visit [https://~~github~~.~~com/OWASP/CheatSheetSeries/blob/master~~/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.md LDAP Injection Prevention Cheat Sheet] to see the latest version of the cheat sheet.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html LDAP Injection Prevention Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 2: / Line 2: @@
 <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div>
-<b>WORK IN PROGRESS</b>
+The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!
-Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
+Please visit [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.md LDAP Injection Prevention Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 94: / Line 94: @@
 Jim Manico - jim[at]owasp.org<br/>
-== Other Cheatsheets ==
+= Other Cheatsheets =
 {{Cheatsheet_Navigation_Body}}

← Older revision		Revision as of 19:18, 10 March 2017
Line 91:		Line 91:
	= Authors and Primary Editors =		= Authors and Primary Editors =

		+	Ben Weintraub - Ben[at]bluetalon.com<br/>
	Jim Manico - jim[at]owasp.org<br/>		Jim Manico - jim[at]owasp.org<br/>

@@ Line 39: / Line 39: @@
 Example:
-  (&(ou=Physics)
+  (&(ou=Physics)(|
-  (|(manager=cn=Freeman Dyson,ou=Physics,dc=Caltech,dc=edu)
+  (manager=cn=Freeman Dyson,ou=Physics,dc=Caltech,dc=edu)
-  (manager=cn=Albert Einstein,ou=Physics,dc=Princeton,dc=edu)))
+  (manager=cn=Albert Einstein,ou=Physics,dc=Princeton,dc=edu)
 When building LDAP queries in application code, you MUST escape any untrusted data that is added to any LDAP query. There are two forms of LDAP escaping. Encoding for LDAP Search and Encoding for LDAP DN (distinguished name). The proper escaping depends on whether you are sanitizing input for a search filter, or you are using a DN as a username-like credential for accessing some resource.

← Older revision		Revision as of 06:02, 10 March 2017
Line 26:		Line 26:

	==Defense Option 1: Escape all variables using the right LDAP encoding function ==		==Defense Option 1: Escape all variables using the right LDAP encoding function ==
		+
		+	The main way LDAP stores names is based on DN (distinguished name). You can think of this like a unique identifier. These are sometimes used to access resources, like a username.
		+
		+	A DN might look like this
		+	cn=Richard Feynman, ou=Physics Department, dc=Caltech, dc=edu
		+	or
		+	uid=inewton, ou=Mathematics Department, dc=Cambridge, dc=com
		+
		+	There are certain characters that are considered special characters in a DN. The exhaustive list is the following: ',','\','#','+','<','>',';','"','=', and leading or trailing spaces
		+
		+	Each DN points to exactly 1 entry, which can be thought of sort of like a row in a RDBMS. For each entry, there will be 1 or more attributes which are analogous to RDBMS columns. If you are interested in searching through LDAP for users will certain attributes, you may do so with search filters. In a search filter, you can use standard boolean logic to get a list of users matching an arbitrary constraint. Search filters are written in Polish notation AKA prefix notation.
		+
		+	Example:
		+	(&(ou=Physics)(\|(manager=cn=Freeman Dyson,ou=Physics,dc=Caltech,dc=edu)
		+	(manager=cn=Albert Einstein,ou=Physics,dc=Princeton,dc=edu)))
		+
		+	When building LDAP queries in application code, you MUST escape any untrusted data that is added to any LDAP query. There are two forms of LDAP escaping. Encoding for LDAP Search and Encoding for LDAP DN (distinguished name). The proper escaping depends on whether you are sanitizing input for a search filter, or you are using a DN as a username-like credential for accessing some resource.

	;Safe Java Escaping Example		;Safe Java Escaping Example

← Older revision		Revision as of 16:23, 9 December 2016
Line 30:		Line 30:

	2008 Java article on LDAP injection defense: https://blogs.oracle.com/shankar/entry/what_is_ldap_injection		2008 Java article on LDAP injection defense: https://blogs.oracle.com/shankar/entry/what_is_ldap_injection
		+
		+	Legacy OWASP ESAPI for Java DefaultEncoder which includes encodeForLDAP(String) and encodeForDN(String): https://github.com/ESAPI/esapi-java-legacy/blob/develop/src/main/java/org/owasp/esapi/reference/DefaultEncoder.java

	;Safe C# .NET TBA Example		;Safe C# .NET TBA Example

← Older revision		Revision as of 07:23, 7 December 2016
Line 30:		Line 30:

	2008 Java article on LDAP injection defense: https://blogs.oracle.com/shankar/entry/what_is_ldap_injection		2008 Java article on LDAP injection defense: https://blogs.oracle.com/shankar/entry/what_is_ldap_injection
−
−	~~ESAPI for Java has two encoding functions for LDAP injection protection. http://owasp-esapi-java.googlecode.com/svn/trunk_doc/latest/org/owasp/esapi/Encoder.html~~
−
−	/**
−	* Encode data for use in LDAP queries.
−	*
−	* @param input the text to encode for LDAP
−	*
−	* @return input encoded for use in LDAP
−	*/
−	~~String encodeForLDAP(String input);~~
−
−	/**
−	* Encode data for use in an LDAP distinguished name.
−	*
−	* @param input the text to encode for an LDAP distinguished name
−	*
−	* @return input encoded for use in an LDAP distinguished name
−	*/
−	~~String encodeForDN(String input);~~
−

	;Safe C# .NET TBA Example		;Safe C# .NET TBA Example

@@ Line 81: / Line 81: @@
 == White List Input Validation ==
-Input validation can be used to detect unauthorized input before it is passed to the SQL query. For more information please see the [[Input Validation Cheat Sheet]].
+Input validation can be used to detect unauthorized input before it is passed to the LDAP query. For more information please see the [[Input Validation Cheat Sheet]].
 = Related Articles =