AntiLdapInjection 1.0.0

Anti-LDAP Injection

A .NET library that provides protection against LDAP Injection.

Most of the of the code was extracted from Microsoft's AntiXss library (v4.3) LDAP Encoder, which is no longer maintained.

Installation

The latest AntiLdapInjection package is available for installation on NuGet. Use any of the following client tool commands listed below to install the package.

• .NET CLI
• NuGet Package Manager
• PackageReference

Install package using dotnet CLI

dotnet add package AntiLdapInjection

Install package using NuGet Package Manager

Install-Package AntiLdapInjection

Install package using PackageReference

For projects that support PackageReference, copy this XML node into the project file to reference the package.

<PackageReference Include="AntiLdapInjection" Version="x.x.x" />

Be sure to replace x.x.x with an appropriate Version.

Usage

FilterEncode

FilterEncode encodes input according to RFC 4515, where unsafe values are converted to \XX (XX is the representation of the unsafe character).

Example: opening/closing parenthesis

string filter = "Parens R Us (for all your parenthetical needs)";
string encoded = LdapEncoder.FilterEncode(filter);
Console.WriteLine(encoded); // "Parens R Us \28for all your parenthetical needs\29"

Example: asterisk in search filter

string filter = "*";
string encoded = LdapEncoder.FilterEncode(filter);
Console.WriteLine(encoded); // "\2A"

Example: backslash in search filter

string filter = @"C:\MyFile";
string encoded = LdapEncoder.FilterEncode(filter);
Console.WriteLine(encoded); // "C:\5CMyFile"

Example: accents in search filter

string filter = "Lučić";
string encoded = LdapEncoder.FilterEncode(filter);
Console.WriteLine(encoded); // "Lu\C4\8Di\C4\87"

DistinguishedNameEncode

DistinguishedNameEncode encodes input according to RFC 2253, where unsafe characters are converted to #XX where XX is the representation of the unsafe character and the comma, plus, quote, slash, less than and great than signs are escaped using slash notation (\X). In addition to this, a space or octothorpe (#) at the beginning of the input string is escaped (\), as is a space at the end of a string.

Example: distinguished name slash notation

string dn = @", + \ "" \ < >";
string encoded = LdapEncoder.DistinguishedNameEncode(dn);
Console.WriteLine(encoded); // "\, \+ \" \\ \< \>"

Example: leading space in distinguished name

string dn = " Hello";
string encoded = LdapEncoder.DistinguishedNameEncode(dn);
Console.WriteLine(encoded); // "\ Hello"

Example: trailing space in distinguished name

string dn = "Hello ";
string encoded = LdapEncoder.DistinguishedNameEncode(dn);
Console.WriteLine(encoded); // "Hello\ "

Example: octothorpe character in distinguished name

string dn = "#Hello";
string encoded = LdapEncoder.DistinguishedNameEncode(dn);
Console.WriteLine(encoded); // "\#Hello"

Example: accents in distinguished name

string dn = "Lučić";
string encoded = LdapEncoder.DistinguishedNameEncode(dn);
Console.WriteLine(encoded); // "Lu#C4#8Di#C4#87"

Initial and final character overrides

You have the option to turn off initial or final character escaping rules. For example, if you are concatenating a escaped distinguished name fragment into the midst of a complete distinguished name.

DistinguishedNameEncode(
string input,
 bool useInitialCharacterRules,
 bool useFinalCharacterRule)

In addition to the RFC mandated escaping, the safe list excludes the characters listed under the LDAP escape sequences section.

LDAP injection resources

• OWASP: LDAP Injection Prevention Cheat Sheet
• OWASP: Testing for LDAP Injection
• Microsoft TechNet: Active Directory Characters to Escape
• Web Application Security Consortium: LDAP Injection
• Black Hat: PDF Whitepaper on LDAP Injection and Blind LDAP Injection
• RFC-1960: A String Representation of LDAP Search Filters
• IBM Redbooks: Understanding LDAP - Design and Implementation
• CWE: Improper Neutralization of Special Elements used in an LDAP Query (LDAP Injection)

Similar libraries

Similar libraries providing protections against LDAP injection, not necessarily in .NET.

Node.js

ldap-escape

ldap-escape is an npm package that provides template literal tag functions for LDAP filters and distinguished names to prevent LDAP injection attacks.