Delete character escaping for passwords#253
Conversation
|
To test this issue, setup a LDAP with a user that has a password containing |
|
Hi @juadde Let us know if you have any insight about this! |
|
As far as I understand it, escaping (as done in escape_filter_chars) is performed to ensure that when a request to the LDAP is performed there will be no possibility to have malicious content in a filter (like (&(objectClass=person)(objectClass=user)) for example). The password should never be part of LDAP filters (the passwords are not stored in pain text anyway - so making a filter with the password value would be useless). Escaping it would only change the password value if some characters are present. It is also possible to unescape the password with unescape_filter_chars() when you use it as a password, but I don't really see the point here. In connection.py it is always used for authentication with SASL, NTLM etc. I am unsure that if we were trying to prevent injections in the authentication protocols we are using the right function (and we would need unescaping the password before giving it to the authentication protocols anyway, as they need the "right" password). I don't know if that helps a little bit? |
|
Hi @juadde Yes indeed, that was an total oversight from us. It makes sense that the pwd are not passed in the LDAP filters so there's not point of filtering the pwd. Which as you said has to be sent as is anyway. We'll merge and push in the next patch. |
2 participants
Hello,
Escaping character will cause passwords check failure in case of characters like
*(I would tend to think that no escape_filter_chars() is needed at all in this file).This is a pull request so passwords with "strange" characters can work.
Kind regards.