From: Jeff - Burly Systems <jeff.burly@...>
Date: 2007-08-25T00:07:23+09:00
Subject: Re: ldap injection

By ldap injection (
http://www.webappsec.org/projects/threat/classes/ldap_injection.shtml
), I was talking about potential security vulnerabilities, similar to
sql injection ( http://manuals.rubyonrails.com/read/chapter/43 )
attacks, and was wondering if Net::LDAP implemented anything internal
(similar to the use of ? in sql query strings in ruby-dbi or
ActiveRecord ) to help prevent such., or if I needed to test for and
attempt to cleanse any such potentially malicious user input
(especailly in regards to uid) before using Net::LDAP.

I'll check out bind_as tho.  Thanks,

Jeff

On 8/24/07, Francis Cianfrocca <garbagecat10@gmail.com> wrote:
> On 8/23/07, Jeff - Burly Systems <jeff.burly@gmail.com> wrote:
> >
> > Any issues / advice guarding against ldap injection when doing a
> > simple pass/fail ldap auth using Net::LDAP#auth and #bind for
> > client-supplied uid and pss?
>
>
>
> I'm not clear on what you mean by "ldap injection." Are you having concerns
> relating to security?
>
> Look at the Net::LDAP#bind_as function. You can do some of this (not the uid
> scrub) in fewer steps.
>