thekid/rfc — Issue #19: RFC 0019: LDAP query infrastructure
Author: thekid
Created: 2011-10-09 14:09:34+00:00
State: closed
Labels: implemented, rfc

@category: peer.ldap

Scope of change
====
Introduce a peer.ldap.LDAPQuery class that controls how queries with
peer.ldap.LDAPClient are done.

Rationale
====
Inspired by rdbms.DBConnection's prepare() method, LDAP queries should
also have some way to sanitize query input: it's needed to simplify
LDAP access and ensure the correctness of LDAP queries.

This is the continuation of the rdbms collection's success of formulating
queries in a way that makes them immune against SQL code injection.

Functionality
====
Example:

```php
connect();
$ldap->bind();

$res= &$ldap->search(new LDAPQuery(
'ou=permissions,o=openldap,c=DE',
'(&(objectClass=simpleSecurityObject)(|(userName=%s|email=%s)))',
$_REQUEST['input'],
$_REQUEST['input']
));

$res= &$ldap->search(new LDAPQuery(
'(&(objectClass=%c)(uid=%d))',
'*',
1552
));
?>
```

More subtile settings can be done, too:

```php
setScope(LDAP_SCOPE_SUB);
$query->setBase('ou=permissions,o=openldap,c=DE');
$query->setFilter('(&(objectClass=foo)(uid=%d))', $_REQUEST['userid']);
$res= &$ldap->search($query);
?>
```

To offer a full interface for an LDAP query, peer.ldap.LDAPQuery should offer
accessors to change query parameters like attributes, attrsonly, sizelimit,
timelimit and deref.

Security considerations
====
The new class would automatically take untrusted input and escape all dangerous
characters dependant on the used token to a secure replacement.
This change is supposed to make the LDAP query infrastructure more secure.

Speed impact
====
The change adds the need to create one more object for an LDAP query, so it will
be slightly slower and has a bigger memory footprint. However, LDAP queries
involve a socket connect and network I/O, so the overhead caused by this change
will be a smaller factor.

Dependencies
====
n/a

Related documents
====
- LDAP Search PHP manual:
http://php3.de/ldap_search

- LDAPQuery implementation:
http://xp-framework.net/downloads/rfc0019.diff

Comments
====
- friebe, Thu Feb 24 21:08:10 CET 2005
LDAPClient::search() already exists and would need to be able to
distinguish if an LDAPQuery object or its current first parameter,
string base_dn. Maybe it would be a good idea to name the new
function searchBy()?

- kiesel, Mon May 16 12:08:39 CEST 2005
Should LDAPClient class get a member $base, which contains the default
base? This could make some things simpler.

- kiesel, Mon May 16 12:08:39 CEST 2005
What should be the default search scope? Should the scope be configureable
with the default constructor?

- kiesel, Mon May 16 12:10:13 CEST 2005
Should all input be automatically encoded to UTF-8? This may be suitable
on iso-8859-1 systems, but sometimes could require manually decoding input
before passing to the LDAPQuery class.