Properly sanitizing LDAP queries in .NET

Supported C# LDAP sanitizers are in Microsoft.Security.Application.Encoder

  • Feb 25, 2021
  • Knowledge

Title
Properly sanitizing LDAP queries in .NET
Details
I have a product written in C# which was flagged for not properly sanitizing LDAP queries. I added code to do this, but Coverity is still complaining about it. Any ideas? Is there a specific library or code I'm expected to use?
Solution
For C# we support the following functions from the Microsoft AntiXSS Library as LDAP sanitizers:
  • Microsoft.Security.Application.Encoder::LdapEncode(System.String)System.String
  • Microsoft.Security.Application.Encoder::LdapFilterEncode(System.String)System.String
  • Microsoft.Security.Application.Encoder::LdapDistinguishedNameEncode(System.String)System.String
  • Microsoft.Security.Application.Encoder::LdapDistinguishedNameEncode(System.String,System.Boolean,System.Boolean)System.String
Product
Coverity Static Analysis/Quality Advisor
Version
2020.12
Platform
Source Language
C#
Component
Coverity Analysis
Compiler
Not Applicable
Keywords
URL Name
Properly-sanitizing-LDAP-queries-in-NET
Coverity (AST)
Did this answer your question?

Disclaimer: The information in this knowledge base article is believed to be accurate as of the date of this publication but is subject to change without notice. You understand and agree that use of this content is at your own discretion and risk and that you will be solely responsible for any damage that results from your use of it. The information is subject to the confidentiality provisions of the Terms & Conditions governing your use of Black Duck services.