8000 Symfony LDAP - Data Safety? · Issue #6795 · symfony/symfony-docs · GitHub
[go: up one dir, main page]
Skip to content

Symfony LDAP - Data Safety? #6795

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
h4ckninja opened this issue Jul 31, 2016 · 5 comments
Closed

Symfony LDAP - Data Safety? #6795

h4ckninja opened this issue Jul 31, 2016 · 5 comments
Labels
hasPR A Pull Request has already been submitted for this issue.

Comments

@h4ckninja
Copy link

Reading the LDAP section (http://symfony.com/doc/current/components/ldap.html), it is fairly limited in information.

As a user of the documentation as a whole, I want to know a few things that the Doctrine information does explain. For example:

  • Who is responsible for protecting against LDAP injection? The LDAP component or the developer (me)?
  • How do I learn about what safety features do exist, barring reading the code? Is that information currently available?
@h4ckninja
Copy link
Author

I just found #5756, so I'll follow along in there.

@h4ckninja h4ckninja mentioned this issue Jul 31, 2016
Closed
@csarrazi
Copy link
Contributor

Hi @micheal. I'll continue this discussion here instead, as this topic is much more specific than the general Ldap component's documentation.

As of now, the LDAP component does not provide any security features, and it falls back on the developer to provide proper escaping. However, the Security component does escape values provided when binding against an LDAP server, likewise for the user provider.

@h4ckninja h4ckninja reopened this Sep 20, 2016
@h4ckninja
Copy link
Author

Cheers. :)

Well in that case, can the documentation be updated to reflect that? I'm happy to help write whatever. I'd just hate to see someone caught off-guard.

@csarrazi
Copy link
Contributor

Sure!

By the way, if you also wish to contribute, feel free to submit a PR here! 😃

@javiereguiluz javiereguiluz added the hasPR A Pull Request has already been submitted for this issue. label Feb 16, 2017
@javiereguiluz javiereguiluz mentioned this issue Feb 16, 2017
Merged
xabbuh added a commit that referenced this issue Mar 13, 2017
@xabbuh
minor #7508 Added a caution note about the LDAP injection attacks (ja…
3d2ce90 
…viereguiluz)

This PR was merged into the 2.8 branch.

Discussion
----------

Added a caution note about the LDAP injection attacks

After reading [this comment](#6795 (comment)) by @csarrazi I'm not sure which protection does the LDAP component offer and which one it doesn't ... so please, review this carefully. Thanks!

Commits
-------

dfc2867 Added a caution note about the LDAP injection attacks
@javiereguiluz
Copy link
Member

Closing it as fixed by #7508.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
hasPR A Pull Request has already been submitted for this issue.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@h4ckninja @javiereguiluz @csarrazi
0