I'm whitelisting the input data to an LDAP/AD search on 'sn' (=surname). The purpose is to stop penetration attacks through the app and into the LDAP servers (i.e. no brackets, please).

// whitelist input data.
string partialName = Regex.Replace(partialName, "[^. a-zA-Z-']", string.Empty);

Do you think this is a useful subset? I don't want to allow anything bad through but it does need to be usable.


Instead of whitelisting I should be escaping characters (@200_success):

// escape LDAP filter string characters.
partialName = 
    .Replace(@"\", @"\5c")
    .Replace(@"*", @"\2a")
    .Replace(@"(", @"\28")
    .Replace(@")", @"\29");

This works against my LDAP server. I can't pass an asterisk anyway as the interface is a REST url and that causes a Request.Path exception.


1 Answer 1


Don't ever make assumptions of what to allow or disallow based on what you have seen in your experience. Always consult the specification, which is, in this case, RFC 4515 Sec 3. The spec will tell you which characters require escaping, and what the escaping mechanism is.

  • \$\begingroup\$ I'm trying to whitelist so I'm only considering what to allow. The only thing the RFC is telling me is don't allow left and right parenthesis: filter = LPAREN filtercomp RPAREN \$\endgroup\$
    – Boggin
    Commented Oct 16, 2013 at 9:07
  • \$\begingroup\$ @Boggin He's right, you should escape rather than whitelist. And for security's sake, make sure you test that you can create and fetch users with "weird" characters, including the escape sequence. \$\endgroup\$
    – l0b0
    Commented Oct 16, 2013 at 15:34
  • \$\begingroup\$ No, you're interpreting the spec wrong. Read the last paragraph on page 3: asterisk, left paren, right paren, backslash, and NUL all must be escaped, and the escaping mechanism is backslash hexdigit hexdigit. \$\endgroup\$ Commented Oct 16, 2013 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.