Jeff - Burly Systems
8/24/2007 1:30:00 AM
Any issues / advice guarding against ldap injection when doing a
simple pass/fail ldap auth using Net::LDAP#auth and #bind for
client-supplied uid and pss?
(Francis et al, ..., Thanks for all the great work on ruby-net-ldap.)
I'm thinking of doing something like the following:
...
def ldap_auth(uid, pss)
return false if not uid or not pss
stripped_uid = uid.gsub(/[^a-zA-Z0-9._-]+/i, '') # locale is en_US.UTF-8
return false if stripped_uid != uid
was_authd = false
usr = "uid=#{uid},ou=people,dc=mydomain,dc=com"
ldap = Net::LDAP.new
ldap.host = "myldapserver"
ldap.port = 389
ldap.auth usr, pss
was_authd = true if ldap.bind
return was_authd
end
...
Thanks,
Jeff