如何防止LDAP注入

Question

我们正在构建一个通过php使用LDAP的应用程序，我开始想到有什么办法可以注入到LDAP中，更好的是如何防止LDAP注入？

Answer 1

When constructing LDAP filters you must ensure that filter values are handled according to RFC2254 :

Any control characters with an ACII code < 32 as well as the characters with special meaning in LDAP filters "*", "(", ")", and "\\" (the backslash) are converted into the representation of a backslash followed by two hex digits representing the hexadecimal value of the character.

Zend_Ldap for example uses the following routine

//[...]
$val = str_replace(array('\\', '*', '(', ')'), array('\5c', '\2a', '\28', '\29'), $val);
for ($i = 0; $i<strlen($val); $i++) {
    $char = substr($val, $i, 1);
    if (ord($char)<32) {
        $hex = dechex(ord($char));
        if (strlen($hex) == 1) $hex = '0' . $hex;
        $val = str_replace($char, '\\' . $hex, $val);
    }
}
//[...]

Answer 2

One item to consider is that an LDAP bind with a Username (DN) but no password is considered an anonymous bind. Therefore should you test to see if the passed credentials can bind via LDAP to validate the user, if they pass a blank password, and you passed it through as is, you could let someone in incorrectly.

Answer 3

In PHP 5.6+ you should be using the ldap_escape function for filter values and RDNs. Such as:

// Escaping an LDAP filter for ldap_search ...
$username = ldap_escape($username, null, LDAP_ESCAPE_FILTER);
$filter = "(sAMAccountName=$username)";

// Escaping a DN to be used in an ldap_add, or a rename...
$rdn = ldap_escape('Smith, John', null, LDAP_ESCAPE_DN);
$dn = "cn=$rdn,dc=example,dc=local";

Additionally, if you're accepting user input for attribute names in searches you should be validating that it's an acceptable OID or attribute name. You can do that with a function like this:

/**
 * Validate an attribute is an OID or a valid string attribute name.
 *
 * @param string
 * @return bool
 */
function isValidAttributeFormat($value)
{
    $matchOid = '/^[0-9]+(\.[0-9]+?)*?$/';
    $matchDescriptor = '/^\pL([\pL\pN-]+)?$/iu';

    return preg_match($matchOid, $value) 
        || preg_match($matchDescriptor, $value);
}

$attribute = 'sAMAccountName';
$value = 'foo';

if (!isValidAttributeFormat($attribute)) {
    throw new \InvalidArgumentException(sprintf('Invalid attribute name: %s', $attribute));
}

$value = ldap_escape($value, null, LDAP_ESCAPE_FILTER);
$filter = "($attribute=$value)";

Answer 4

In most cases it is using a read-only account for LDAP. Since LDAP is poor at writes updates only occur in very small sections of the application where another account can be used.

Even then the query language and the update language are completely separated.

To protect against displaying unwanted information treat all user input as tainted and make sure tainted data is never used before being parsed, cleaned and properly escaped and copied to a clean variable.

Similarly you might consider only picking the data you expect from the response and return that for display.

Answer 5

function ldap_quote($str) {
    return str_replace(
            array( '\\', ' ', '*', '(', ')' ),
            array( '\\5c', '\\20', '\\2a', '\\28', '\\29' ),
            $str
    );
}