4
4
<qhelp >
5
5
<overview >
6
6
<p >If an LDAP query or DN is built using string concatenation or string formatting, and the
7
- components of the concatenation include user input without any proper sanitization, a user
7
+ components of the concatenation include user input without any proper sanitization, a user
8
8
is likely to be able to run malicious LDAP queries.</p >
9
9
</overview >
10
10
11
11
<recommendation >
12
12
<p >If user input must be included in an LDAP query or DN, it should be escaped to
13
13
avoid a malicious user providing special characters that change the meaning
14
- of the query. In Python2, user input should be escaped with <code >ldap.dn.escape_dn_chars</code >
15
- or <code >ldap.filter.escape_filter_chars</code >, while in Python3, user input should be escaped with
14
+ of the query. In Python2, user input should be escaped with <code >ldap.dn.escape_dn_chars</code >
15
+ or <code >ldap.filter.escape_filter_chars</code >, while in Python3, user input should be escaped with
16
16
<code >ldap3.utils.dn.escape_rdn</code > or <code >ldap3.utils.conv.escape_filter_chars</code >
17
- depending on the component tainted by the user. A good practice is to escape filter characters
17
+ depending on the component tainted by the user. A good practice is to escape filter characters
18
18
that could change the meaning of the query (https://tools.ietf.org/search/rfc4515#section-3).</p >
19
19
</recommendation >
20
20
21
21
<example >
22
- <p >In the following examples, the code accepts both <code >username</code > and <code >dc</code > from the user,
22
+ <p >In the following examples, the code accepts both <code >username</code > and <code >dc</code > from the user,
23
23
which it then uses to build a LDAP query and DN.</p >
24
24
25
25
<p >The first and the second example uses the unsanitized user input directly
@@ -30,7 +30,7 @@ components, and search for a completely different set of values.</p>
30
30
<sample src =" examples/example_bad1.py" />
31
31
<sample src =" examples/example_bad2.py" />
32
32
33
- <p >In the third and four example, the input provided by the user is sanitized before it is included in the search filter or DN.
33
+ <p >In the third and fourth example, the input provided by the user is sanitized before it is included in the search filter or DN.
34
34
This ensures the meaning of the query cannot be changed by a malicious user.</p >
35
35
36
36
<sample src =" examples/example_good1.py" />
0 commit comments