Fix LDAP filter injection in benchmark case 44

expectedresults-1.2.csv

@@ -42,7 +42,7 @@ BenchmarkTest00040,pathtraver,true,22
 BenchmarkTest00041,xss,true,79
 BenchmarkTest00042,weakrand,false,330
 BenchmarkTest00043,sqli,true,89
-BenchmarkTest00044,ldapi,true,90
+BenchmarkTest00044,ldapi,false,90
 BenchmarkTest00045,pathtraver,true,22
 BenchmarkTest00046,hash,true,328
 BenchmarkTest00047,xss,true,79

src/main/java/org/owasp/benchmark/helpers/LDAPManager.java

@@ -89,6 +89,10 @@ public boolean insert(LDAPPerson person) {
         return true;
     }
 
+    public static String createPersonUidFilter(String uid) {
+        return "(&(objectclass=person)(uid=" + ESAPI_Encoder.encodeForLDAP(uid) + "))";
+    }
+
     /**
      * Search LDAPPerson by name
      *

src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00044.java

@@ -53,7 +53,7 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
             String base = "ou=users,ou=system";
             javax.naming.directory.SearchControls sc = new javax.naming.directory.SearchControls();
             sc.setSearchScope(javax.naming.directory.SearchControls.SUBTREE_SCOPE);
-            String filter = "(&(objectclass=person)(uid=" + param + "))";
+            String filter = org.owasp.benchmark.helpers.LDAPManager.createPersonUidFilter(param);
             boolean found = false;
             javax.naming.NamingEnumeration<javax.naming.directory.SearchResult> results =
                     ctx.search(base, filter, sc);

src/test/java/org/owasp/benchmark/helpers/LDAPManagerTest.java

@@ -0,0 +1,34 @@
+/**
+ * OWASP Benchmark Project
+ *
+ * <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
+ *
+ * <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation, version 2.
+ *
+ * <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE. See the GNU General Public License for more details.
+ */
+package org.owasp.benchmark.helpers;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import org.junit.jupiter.api.Test;
+
+class LDAPManagerTest {
+
+    @Test
+    void personUidFilterPreservesOrdinaryUid() {
+        assertEquals(
+                "(&(objectclass=person)(uid=alice))",
+                LDAPManager.createPersonUidFilter("alice"));
+    }
+
+    @Test
+    void personUidFilterEscapesFilterMetacharactersInUid() {
+        assertEquals(
+                "(&(objectclass=person)(uid=\\2a\\29\\28uid=\\2a\\29))",
+                LDAPManager.createPersonUidFilter("*)(uid=*)"));
+    }
+}