sanitizing ldap search. I think, in this case it only prevents ldap search

errors. Backend does not enclose search in () and custom search options
can't be inserted. If I am wrong, attacker was able to scrap some complex
cn=*something* search expression, that could abuse ldap backend or ldap
server.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@8894 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/ChangeLog b/ChangeLog
index dddc19608d70fd1d01731df9b04b01270fc46cd6..c96ad4f79c9c6ecd4a58eb31c6914d710351d318 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -236,6 +236,12 @@ Version 1.5.1 -- CVS
   - Fixed bug #801060.  Removed option for INBOX in filters plugin as source
     is always INBOX.
   - Always show Purge link next to Trash, even when empty.
+  - errors in addressbook_init() function are no longer fatal. If function
+    fails to activate address book backend, it displays error box (with 
+    error_box() function). error box can be hidden by setting first
+    function argument to false.
+  - Sanitized search in ldap address book backend. Use of asterisk 
+    together with other symbols is not supported.
 
 Version 1.5.0
 --------------------

diff --git a/functions/abook_ldap_server.php b/functions/abook_ldap_server.php
index bd6a5bbec19669fed0452d65666060d31d6acb8b..3e1151775192312bf09e44c801faec2436c5d9b3 100644 (file)
--- a/functions/abook_ldap_server.php
+++ b/functions/abook_ldap_server.php
@@ -231,6 +231,23 @@ class abook_ldap_server extends addressbook_backend {
         }
     }
 
+    /**
+     * Sanitizes ldap search strings.
+     * See rfc2254
+     * @link http://www.faqs.org/rfcs/rfc2254.html
+     * @since 1.5.1
+     * @param string $string
+     * @return string sanitized string
+     */
+    function ldapspecialchars($string) {
+        $sanitized=array('\\' => '\5c',
+                         '*' => '\2a',
+                         '(' => '\28',
+                         ')' => '\29',
+                         "\x00" => '\00');
+
+        return str_replace(array_keys($sanitized),array_values($sanitized),$string);
+    }
 
     /* ========================== Public ======================== */
 
@@ -240,14 +257,18 @@ class abook_ldap_server extends addressbook_backend {
      * @return array search results
      */
     function search($expr) {
-
         /* To be replaced by advanded search expression parsing */
         if(is_array($expr)) return false;
 
         /* Encode the expression */
         $expr = $this->charset_encode($expr);
-        if(strstr($expr, '*') === false) {
-            $expr = "*$expr*";
+
+        /*
+         * allow use of one asterisk in search. 
+         * Don't allow any ldap special chars if search is different
+         */
+        if($expr!='*') {
+            $expr = '*' . $this->ldapspecialchars($expr) . '*';
         }
         $expression = "cn=$expr";