Node-ldapjs: Ldap command injection?

[gdw2]

It ldapjs susceptible to ldap injection of any sort? For example, if a nodejs app takes input from a web for and uses it in a client.search command, it is conceivable that an attacker could craft a string that when put into the client.search command could actually end up deleting directory entries (even if the nodejs code never calls client.del)?

[pfmooney]

I believe that the structure of the protocol makes such a situation unlikely.
That said, if you're using user-provided data in a search (or any other operation) I would do everything I could to cleanse the input.

If a user's search is being used in a filter, for example, I would create the filter with objects:
filter = new ldap.filters.EqualityFilter({attribute: 'name', value: user_input})
instead of the potentially dangerous choice of parsing it:
dangerFilter = ldap.parseFilter('(name=' + user_input + ')')

[shaozi]

when using client.bind(dn, password, callback), and dn is a user input. Do I need to sanitize dn? If yes, how?

[jsumners]

@shaozi you could attempt to validate that the string passes validation for a proper DN string, but that'd be about all you can do. That's an exercise left up to you -- https://duckduckgo.com/?q=validate+ldap+dn&t=vivaldi&ia=web