...
A whitelist can be used to restrict input to a list of valid characters. Characters that must be excluded from whitelists — including whitelists—including Java Naming and Directory Interface (JNDI) metacharacters and LDAP special characters — arecharacters—are:
Character | Name |
|---|---|
| Single and double quote |
| Forward slash and backslash |
| Double slashes* |
space | Space character at beginning or end of string |
| Hash character at the beginning of the string |
| Angle brackets |
| Comma and semicolon |
| Addition and multiplication operators |
| Round braces |
| Unicode NULL character |
* This is a character sequence
...
A search for a valid user name and password often takes the form:
| Code Block |
|---|
(&(sn=<USERSN>)(userPassword=<USERPASSWORD>)) |
...
When a database field such as a password must include special characters, it is critical to ensure that the authentic data is stored in sanitized form in the database and also that any user input is normalized before the validation or comparison takes place. We discourage use of characters that have special meanings in JNDI and LDAP in the absence of a comprehensive normalization and whitelisting-based routine. Refer to IDS50-JG. Properly encode or escape output for examples on of output encoding and escaping. Special characters must be transformed to sanitized safe values before they are added to the whitelist expression against which input will be validated. Likewise, normalization of user input (escaping and encoding) should occur before the validation step.
...
Failure to sanitize untrusted input can result in information disclosure and privilege escalation.
Bibliography
...