From: Jeff - Burly Systems <jeff.burly@...>
Date: 2007-08-24T10:30:11+09:00
Subject: ldap injection

Any issues / advice guarding against ldap injection when doing a
simple pass/fail ldap auth using Net::LDAP#auth and #bind for
client-supplied uid and pss?

(Francis et al, ..., Thanks for all the great work on ruby-net-ldap.)

I'm thinking of doing something like the following:

...
def ldap_auth(uid, pss)
  return false if not uid or not pss

  stripped_uid = uid.gsub(/[^a-zA-Z0-9._-]+/i, '')  # locale is en_US.UTF-8
  return false if stripped_uid != uid

  was_authd = false
  usr = "uid=#{uid},ou=people,dc=mydomain,dc=com"
  ldap = Net::LDAP.new
  ldap.host = "myldapserver"
  ldap.port = 389
  ldap.auth usr, pss
  was_authd = true if ldap.bind

  return was_authd
end
...

Thanks,

Jeff