1

Escaping comma in distinguished name is throwing "Invalid LDAP search query".

I am trying to fix a security ldap injection violation. When I search with dn, special characters needs to be escaped per owasp recommendation. So, I have added the below method to escape. The below method return this string for dn "ou=User Accounts\,dc=abc\,dc=com" and same passed to ldap. Finally, it throws "Invalid LDAP search query".

public static String encodeDistinguishedName(String name) {
        StringBuilder sb = new StringBuilder();
        if ((name.length() > 0) && ((name.charAt(0) == ' ') || (name.charAt(0) == '#'))) {
            sb.append('\\'); // add the leading backslash if needed
        }
        for (int i = 0; i < name.length(); i++) {
            char curChar = name.charAt(i);
            switch (curChar) {
                case '\\':
                    sb.append("\\\\");
                    break;
                case ',':
                    sb.append("\\\\,");
                    break;
                case '+':
                    sb.append("\\+");
                    break;
                case '"':
                    sb.append("\\\"");
                    break;
                case '<':
                    sb.append("\\<");
                    break;
                case '>':
                    sb.append("\\>");
                    break;
                case ';':
                    sb.append("\\;");
                    break;
                default:
                    sb.append(curChar);
            }
        }
        if ((name.length() > 1) && (name.charAt(name.length() - 1) == ' ')) {
            sb.insert(sb.length() - 1, '\\'); // add the trailing backslash if needed
        }
        return sb.toString();
    }


public static final String encodeSearchFilter(String filter) {
        StringBuilder sb = new StringBuilder();
        for (int i = 0; i < filter.length(); i++) {
            char curChar = filter.charAt(i);
            switch (curChar) {
            case '\\':
                sb.append("\\5c");
                break;
            case '*':
                sb.append("\\2a");
                break;
            case '(':
                sb.append("\\28");
                break;
            case ')':
                sb.append("\\29");
                break;
            case '\u0000':
                sb.append("\\00");
                break;
            default:
                sb.append(curChar);
            }
        }
        return sb.toString();
    }
VIJAYKUMAR SUBRAMANI
  • 53
  • 1
  • 11
  • It would help if you also detail how the filter is built and what is the resulting filter. It's not the DN escaping that is incorrect, it's how it's used in the Search filter. – Ludovic Poitou Nov 13 '19 at 09:39
  • See method "encodeSearchFilter" in the description. – VIJAYKUMAR SUBRAMANI Nov 13 '19 at 10:20
  • 2
    This doesn't help with understanding how a DN used in a filter is escaped, but it seems to me that there is unnecessary double escaping. More specifically, the comma in a DN should only be escaped if it's part of an Attribute Value and not as the separator of RDNs. – Ludovic Poitou Nov 13 '19 at 11:31
  • 1
    DN string representation uses the comma as separator so if you escape those separators you will get the error. As Ludovic said you should only escape commas in attribute values, like if you were to rename `User Accounts` into `A,B,C Accounts`, the resulting dn would be `ou=A\,B\,C Accounts,dc=abc,dc=com`. But your actual dn should be `ou=User Accounts,dc=abc,dc=com`. – EricLavault Nov 13 '19 at 12:35
  • Got it. Thanks. Let me check by changing the implementation to escape the attribute values. – VIJAYKUMAR SUBRAMANI Nov 13 '19 at 14:08
  • How about escaping the filters? This is my filter (&(objectClass=User)(|(memberOf=CN=DI QA Team,OU=Distribution,OU=Groups,DC=abc,DC=com)(memberOf=CN=Development Dept,OU=Domain Global,OU=Security,OU=Groups,DC=abc,DC=com))) Do we have to escape whole filter string? – VIJAYKUMAR SUBRAMANI Nov 13 '19 at 14:49

0 Answers0