title | description | ms.date | author | ms.author | dev_langs | f1_keywords | |||
---|---|---|---|---|---|---|---|---|---|
CA3005: Review code for LDAP injection vulnerabilities (code analysis) |
Learn about code analysis rule CA3005: Review code for LDAP injection vulnerabilities |
04/03/2019 |
dotpaul |
paulming |
|
|
Property | Value |
---|---|
Rule ID | CA3005 |
Title | Review code for LDAP injection vulnerabilities |
Category | Security |
Fix is breaking or non-breaking | Non-breaking |
Enabled by default in .NET 8 | No |
Potentially untrusted HTTP request input reaches an LDAP statement.
By default, this rule analyzes the entire codebase, but this is configurable.
When working with untrusted input, be mindful of Lightweight Directory Access Protocol (LDAP) injection attacks. An attacker can potentially run malicious LDAP statements against information directories. Applications that use user input to construct dynamic LDAP statements to access directory services are particularly vulnerable.
This rule attempts to find input from HTTP requests reaching an LDAP statement.
Note
This rule can't track data across assemblies. For example, if one assembly reads the HTTP request input and then passes it to another assembly that executes an LDAP statement, this rule won't produce a warning.
Note
There is a configurable limit to how deep this rule will analyze data flow across method calls. See Analyzer Configuration for how to configure the limit in an EditorConfig file.
For the user-controlled portion of LDAP statements, consider one o:
- Allow only a safe list of non-special characters.
- Disallow special character
- Escape special characters.
See OWASP's LDAP Injection Prevention Cheat Sheet for more guidance.
If you know the input has been validated or escaped to be safe, it's okay to suppress this warning.
If you just want to suppress a single violation, add preprocessor directives to your source file to disable and then re-enable the rule.
#pragma warning disable CA3005
// The code that's violating the rule is on this line.
#pragma warning restore CA3005
To disable the rule for a file, folder, or project, set its severity to none
in the configuration file.
[*.{cs,vb}]
dotnet_diagnostic.CA3005.severity = none
For more information, see How to suppress code analysis warnings.
Use the following options to configure which parts of your codebase to run this rule on.
You can configure these options for just this rule, for all rules it applies to, or for all rules in this category (Security) that it applies to. For more information, see Code quality rule configuration options.
[!INCLUDEexcluded-symbol-names]
[!INCLUDEexcluded-type-names-with-derived-types]
using System;
using System.DirectoryServices;
public partial class WebForm : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
string userName = Request.Params["user"];
string filter = "(uid=" + userName + ")"; // searching for the user entry
// In this example, if we send the * character in the user parameter which will
// result in the filter variable in the code to be initialized with (uid=*).
// The resulting LDAP statement will make the server return any object that
// contains a uid attribute.
DirectorySearcher searcher = new DirectorySearcher(filter);
SearchResultCollection results = searcher.FindAll();
// Iterate through each SearchResult in the SearchResultCollection.
foreach (SearchResult searchResult in results)
{
// ...
}
}
}
Imports System
Imports System.DirectoryServices
Partial Public Class WebForm
Inherits System.Web.UI.Page
Protected Sub Page_Load(send As Object, e As EventArgs)
Dim userName As String = Me.Request.Params(""user"")
Dim filter As String = ""(uid="" + userName + "")"" ' searching for the user entry
' In this example, if we send the * character in the user parameter which will
' result in the filter variable in the code to be initialized with (uid=*).
' The resulting LDAP statement will make the server return any object that
' contains a uid attribute.
Dim searcher As DirectorySearcher = new DirectorySearcher(filter)
Dim results As SearchResultCollection = searcher.FindAll()
' Iterate through each SearchResult in the SearchResultCollection.
For Each searchResult As SearchResult in results
' ...
Next searchResult
End Sub
End Class