This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Preventing LDAP Injection in Java"
From OWASP
m (Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.) |
|||
| (20 intermediate revisions by 6 users not shown) | |||
| Line 1: | Line 1: | ||
| − | == | + | {{taggedDocument |
| − | + | | type=old | |
| + | | lastRevision=2008-03-01 | ||
| + | | comment=Please visit https://www.owasp.org/index.php/LDAP_Injection_Prevention_Cheat_Sheet | ||
| + | }} | ||
==Approach== | ==Approach== | ||
| − | The best way to prevent LDAP injection is to use a positive validation scheme for ensuring that the data going into your queries doesn't contain any attacks. You can read more in [[:Category:OWASP Guide Project|the OWASP Guide]] about input validation. | + | The best way to prevent LDAP injection is to use a positive validation scheme for ensuring that the data going into your queries doesn't contain any attacks. You can read more in [[:Category:OWASP Guide Project|the OWASP Development Guide]] about input validation. |
However, in some cases, it is necessary to include special characters in input that is passed into an LDAP query. In this case, using escaping can prevent the LDAP interpreter from thinking those special characters are actually LDAP query. Rather, the encoding lets the interpreter treat those special characters as data. | However, in some cases, it is necessary to include special characters in input that is passed into an LDAP query. In this case, using escaping can prevent the LDAP interpreter from thinking those special characters are actually LDAP query. Rather, the encoding lets the interpreter treat those special characters as data. | ||
| Line 9: | Line 12: | ||
Here are a few methods for escaping certain meta-characters in LDAP queries. Both the distinguished name (DN) and the search filter have their own sets of meta-characters. In the case of Java, it is also necessary to escape any JNDI meta-characters, since java uses JNDI to perform LDAP queries. | Here are a few methods for escaping certain meta-characters in LDAP queries. Both the distinguished name (DN) and the search filter have their own sets of meta-characters. In the case of Java, it is also necessary to escape any JNDI meta-characters, since java uses JNDI to perform LDAP queries. | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
public static String escapeDN(String name) { | public static String escapeDN(String name) { | ||
StringBuffer sb = new StringBuffer(); // If using JDK >= 1.5 consider using StringBuilder | StringBuffer sb = new StringBuffer(); // If using JDK >= 1.5 consider using StringBuilder | ||
| Line 83: | Line 50: | ||
return sb.toString(); | return sb.toString(); | ||
} | } | ||
| + | |||
| + | Escaping the search filter: | ||
| + | |||
public static final String escapeLDAPSearchFilter(String filter) { | public static final String escapeLDAPSearchFilter(String filter) { | ||
StringBuffer sb = new StringBuffer(); // If using JDK >= 1.5 consider using StringBuilder | StringBuffer sb = new StringBuffer(); // If using JDK >= 1.5 consider using StringBuilder | ||
| Line 123: | Line 93: | ||
assertEquals("LDAP Christams Tree", "Hi \\28This\\29 = is \\2a a \\5c test # ç à ô", SecTool.escapeLDAPSearchFilter("Hi (This) = is * a \\ test # ç à ô")); | assertEquals("LDAP Christams Tree", "Hi \\28This\\29 = is \\2a a \\5c test # ç à ô", SecTool.escapeLDAPSearchFilter("Hi (This) = is * a \\ test # ç à ô")); | ||
| − | [[Category: | + | [[Category:Java]] |
Latest revision as of 21:48, 10 November 2017
This page contains out-of-date content. Please help OWASP to FixME.
Last revision (yyyy-mm-dd): 2008-03-01
Comment: Please visit https://www.owasp.org/index.php/LDAP_Injection_Prevention_Cheat_Sheet
Last revision (yyyy-mm-dd): 2008-03-01
Comment: Please visit https://www.owasp.org/index.php/LDAP_Injection_Prevention_Cheat_Sheet
Approach
The best way to prevent LDAP injection is to use a positive validation scheme for ensuring that the data going into your queries doesn't contain any attacks. You can read more in the OWASP Development Guide about input validation.
However, in some cases, it is necessary to include special characters in input that is passed into an LDAP query. In this case, using escaping can prevent the LDAP interpreter from thinking those special characters are actually LDAP query. Rather, the encoding lets the interpreter treat those special characters as data.
Here are a few methods for escaping certain meta-characters in LDAP queries. Both the distinguished name (DN) and the search filter have their own sets of meta-characters. In the case of Java, it is also necessary to escape any JNDI meta-characters, since java uses JNDI to perform LDAP queries.
public static String escapeDN(String name) {
StringBuffer sb = new StringBuffer(); // If using JDK >= 1.5 consider using StringBuilder
if ((name.length() > 0) && ((name.charAt(0) == ' ') || (name.charAt(0) == '#'))) {
sb.append('\\'); // add the leading backslash if needed
}
for (int i = 0; i < name.length(); i++) {
char curChar = name.charAt(i);
switch (curChar) {
case '\\':
sb.append("\\\\");
break;
case ',':
sb.append("\\,");
break;
case '+':
sb.append("\\+");
break;
case '"':
sb.append("\\\"");
break;
case '<':
sb.append("\\<");
break;
case '>':
sb.append("\\>");
break;
case ';':
sb.append("\\;");
break;
default:
sb.append(curChar);
}
}
if ((name.length() > 1) && (name.charAt(name.length() - 1) == ' ')) {
sb.insert(sb.length() - 1, '\\'); // add the trailing backslash if needed
}
return sb.toString();
}
Escaping the search filter:
public static final String escapeLDAPSearchFilter(String filter) {
StringBuffer sb = new StringBuffer(); // If using JDK >= 1.5 consider using StringBuilder
for (int i = 0; i < filter.length(); i++) {
char curChar = filter.charAt(i);
switch (curChar) {
case '\\':
sb.append("\\5c");
break;
case '*':
sb.append("\\2a");
break;
case '(':
sb.append("\\28");
break;
case ')':
sb.append("\\29");
break;
case '\u0000':
sb.append("\\00");
break;
default:
sb.append(curChar);
}
}
return sb.toString();
}
Test class:
//escapeDN
assertEquals("No special characters to escape", "Helloé", escapeDN("Helloé"));
assertEquals("leading #", "\\# Helloé", escapeDN("# Helloé"));
assertEquals("leading space", "\\ Helloé", escapeDN(" Helloé"));
assertEquals("trailing space", "Helloé\\ ", escapeDN("Helloé "));
assertEquals("only 3 spaces", "\\ \\ ", escapeDN(" "));
assertEquals("Christmas Tree DN", "\\ Hello\\\\ \\+ \\, \\\"World\\\" \\;\\ ", Test.escapeDN(" Hello\\ + , \"World\" ; "));
assertEquals("No special characters to escape", "Hi This is a test #çà", SecTool.escapeLDAPSearchFilter("Hi This is a test #çà"));
assertEquals("LDAP Christams Tree", "Hi \\28This\\29 = is \\2a a \\5c test # ç à ô", SecTool.escapeLDAPSearchFilter("Hi (This) = is * a \\ test # ç à ô"));
