Skip to content

Escape Username in LDAP search filters #96

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Apr 19, 2022
Merged

Conversation

tippexs
Copy link
Contributor

@tippexs tippexs commented Apr 17, 2022

To limit the risk of LDAP Query injection attacks by misusing the Username, the Username should be escaped probably.

Added Test 22 to cover this case.

Test-Output

1..24
ok 1 - proper user with proper pass
ok 2 - proper user with incorrect pass
ok 3 - similar user with user1 pass
ok 4 - random user with random pass
ok 5 - user2 with proper pass
ok 6 - user3 with proper pass
ok 7 - empty user no password
ok 8 - no auth header
ok 9 - proper user with proper pass cookie
ok 10 - proper user with incorrect pass cookie
ok 11 - random user with random pass cookie
ok 12 - user2 with proper pass cookie
ok 13 - user3 with proper pass cookie
ok 14 - user3 with proper pass broken base64
ok 15 - user3 with proper pass broken cookie
ok 16 - proper user with proper pass with ssl
ok 17 - proper user with proper pass with starttls
ok 18 - dn must be set
ok 19 - url must be set
ok 20 - server2 user via referral on server1
ok 21 - unknown user with referral on server1
ok 22 - Injection Attempt in Username will be escaped and blocked.
ok 23 - no alerts
ok 24 - no sanitizer errors
Coverage report: docker cp <cid>:/tmp/nginx-test-oTIlkztVYF/htmlcov <hostdir>

@lcrilly lcrilly merged commit 2ef1e5c into nginxinc:master Apr 19, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants