I'm whitelisting the input data to an LDAP/AD search on 'sn' (=surname). The purpose is to stop penetration attacks through the app and into the LDAP servers (i.e. no brackets, please).
// whitelist input data. string partialName = Regex.Replace(partialName, "[^. a-zA-Z-']", string.Empty);
Do you think this is a useful subset? I don't want to allow anything bad through but it does need to be usable.
Instead of whitelisting I should be escaping characters (@200_success):
// escape LDAP filter string characters. partialName = partialName .Replace(@"\", @"\5c") .Replace(@"*", @"\2a") .Replace(@"(", @"\28") .Replace(@")", @"\29");
This works against my LDAP server. I can't pass an asterisk anyway as the interface is a REST url and that causes a Request.Path exception.