이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.ID: csharp-security/ldap-injection
Language: C#
Severity: Warning
Category: Security
CWE: 90
Description
Unvalidated user inputs may lead to LDAP injection. Always escape characters in your LDAP queries. Do not build LDAP queries manually.
Learn More
Non-Compliant Code Examples
public class MyController : Controller
{
public bool userExists(string user, string pass)
{
DirectoryEntry directory = new DirectoryEntry();
DirectorySearcher directorySearch = new DirectorySearcher(directory);
directorySearch.Filter = "(&(uid=" + user + ")(userPassword=" + pass + "))";
return directorySearch.FindOne() != null;
}
}
Compliant Code Examples
public class MyController : Controller
{
public bool userExists(string user, string pass)
{
// Safe: using parameterized/escaped LDAP query
DirectoryEntry directory = new DirectoryEntry();
DirectorySearcher directorySearch = new DirectorySearcher(directory);
string escapedUser = EscapeLdapSearchFilter(user);
directorySearch.Filter = "(objectclass=person)";
return directorySearch.FindOne() != null;
}
}
원활한 통합. Datadog Code Security를 경험해 보세요
