Whitelist input data for a lookup by name

Question

I'm whitelisting the input data to an LDAP/AD search on 'sn' (=surname). The purpose is to stop penetration attacks through the app and into the LDAP servers (i.e. no brackets, please).

// whitelist input data.
string partialName = Regex.Replace(partialName, "[^. a-zA-Z-']", string.Empty);

Do you think this is a useful subset? I don't want to allow anything bad through but it does need to be usable.

UPDATE

Instead of whitelisting I should be escaping characters (@200_success):

// escape LDAP filter string characters.
partialName = 
 partialName
 .Replace(@"\", @"5円c")
 .Replace(@"*", @"2円a")
 .Replace(@"(", @"28円")
 .Replace(@")", @"29円");

This works against my LDAP server. I can't pass an asterisk anyway as the interface is a REST url and that causes a Request.Path exception.

• Dan Lyons: You should be able to use asterisks as long as you encode them when issuing the request. See allowing asterisk in URL and HttpServerUtility.UrlEncode.

Answer 1

Don't ever make assumptions of what to allow or disallow based on what you have seen in your experience. Always consult the specification, which is, in this case, RFC 4515 Sec 3. The spec will tell you which characters require escaping, and what the escaping mechanism is.

• Boggin: I'm trying to whitelist so I'm only considering what to allow. The only thing the RFC is telling me is don't allow left and right parenthesis: filter = LPAREN filtercomp RPAREN
• l0b0: @Boggin He's right, you should escape rather than whitelist. And for security's sake, make sure you test that you can create and fetch users with "weird" characters, including the escape sequence.
• 200_success: No, you're interpreting the spec wrong. Read the last paragraph on page 3: asterisk, left paren, right paren, backslash, and NUL all must be escaped, and the escaping mechanism is backslash hexdigit hexdigit.