xp-framework/rfc — Issue #19: LDAP query infrastructure
Author: kiesel
Created: 2011-10-17 15:36:29+00:00
State: closed
Labels: framework, implemented

@category: peer.ldap

Scope of change
====
Introduce a peer.ldap.LDAPQuery class that controls how queries with
peer.ldap.LDAPClient are done.

Rationale
====
Inspired by rdbms.DBConnection's prepare() method, LDAP queries should
also have some way to sanitize query input: it's needed to simplify
LDAP access and ensure the correctness of LDAP queries.

This is the continuation of the rdbms collection's success of formulating
queries in a way that makes them immune against SQL code injection.

Functionality
====
Example:

```php
connect();
$ldap->bind();

$res= &$ldap->search(new LDAPQuery(
'ou=permissions,o=openldap,c=DE',
'(&(objectClass=simpleSecurityObject)(|(userName=%s|email=%s)))',
$_REQUEST['input'],
$_REQUEST['input']
));

$res= &$ldap->search(new LDAPQuery(
'(&(objectClass=%c)(uid=%d))',
'*',
1552
));
?>
```

More subtile settings can be done, too:

```php
setScope(LDAP_SCOPE_SUB);
$query->setBase('ou=permissions,o=openldap,c=DE');
$query->setFilter('(&(objectClass=foo)(uid=%d))', $_REQUEST['userid']);
$res= &$ldap->search($query);
?>
```

To offer a full interface for an LDAP query, peer.ldap.LDAPQuery should offer
accessors to change query parameters like attributes, attrsonly, sizelimit,
timelimit and deref.

Security considerations
====
The new class would automatically take untrusted input and escape all dangerous
characters dependant on the used token to a secure replacement.
This change is supposed to make the LDAP query infrastructure more secure.

Speed impact
====
The change adds the need to create one more object for an LDAP query, so it will
be slightly slower and has a bigger memory footprint. However, LDAP queries
involve a socket connect and network I/O, so the overhead caused by this change
will be a smaller factor.

Dependencies
====
n/a

Related documents
====
- LDAP Search PHP manual:
http://php3.de/ldap_search

- LDAPQuery implementation:
http://xp-framework.net/downloads/rfc0019.diff