I'm whitelisting the input data to an LDAP/AD search on 'sn' (=surname). The purpose is to stop penetration attacks through the app and into the LDAP servers (i.e. no brackets, please).

// whitelist input data.
string partialName = Regex.Replace(partialName, "[^. a-zA-Z-']", string.Empty);

Do you think this is a useful subset? I don't want to allow anything bad through but it does need to be usable.


Instead of whitelisting I should be escaping characters (@200_success):

// escape LDAP filter string characters.
partialName = 
    .Replace(@"\", @"\5c")
    .Replace(@"*", @"\2a")
    .Replace(@"(", @"\28")
    .Replace(@")", @"\29");

This works against my LDAP server. I can't pass an asterisk anyway as the interface is a REST url and that causes a Request.Path exception.


Don't ever make assumptions of what to allow or disallow based on what you have seen in your experience. Always consult the specification, which is, in this case, RFC 4515 Sec 3. The spec will tell you which characters require escaping, and what the escaping mechanism is.

| improve this answer | |
  • \$\begingroup\$ I'm trying to whitelist so I'm only considering what to allow. The only thing the RFC is telling me is don't allow left and right parenthesis: filter = LPAREN filtercomp RPAREN \$\endgroup\$ – Boggin Oct 16 '13 at 9:07
  • \$\begingroup\$ @Boggin He's right, you should escape rather than whitelist. And for security's sake, make sure you test that you can create and fetch users with "weird" characters, including the escape sequence. \$\endgroup\$ – l0b0 Oct 16 '13 at 15:34
  • \$\begingroup\$ No, you're interpreting the spec wrong. Read the last paragraph on page 3: asterisk, left paren, right paren, backslash, and NUL all must be escaped, and the escaping mechanism is backslash hexdigit hexdigit. \$\endgroup\$ – 200_success Oct 16 '13 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.