Link to home
Start Free TrialLog in
Avatar of silentthread2k
silentthread2kFlag for United States of America

asked on

Is there a way to better my LDAP filter security

Here is what is happening. I'm passing a value into a directorySearcher filter and it works great, but HP Fortify is complaining that the input is from an untrusted source.

It recommended that I validate it with a RegEx expression, but HP fortify is still not liking the input.  Is there a such thing as a parameterized LDAP value that I can pass, like I do with Oracle queries?

Here is the snippet...


string whitelist = "[_a-zA-Z0-9]{1,30}$";
                Regex pattern = new Regex(whitelist);
                  
                        
                        if (pattern.IsMatch(value))
                {
                              var directorySearcher = new DirectorySearcher();
                    directorySearcher.PropertiesToLoad.Add("orclnetdescstring");
                    directorySearcher.SearchRoot = directoryEntry;
                    directorySearcher.SearchScope = SearchScope.Subtree;                    
                    directorySearcher.Filter = "(&(objectclass=orclNetService)(cn=" + value + "))";
                    searchResult = directorySearcher.FindOne();
                }
ASKER CERTIFIED SOLUTION
Avatar of Aard Vark
Aard Vark
Flag of Australia image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial