Security

last person joined: 8 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

What does the NwaNormalizeEmail conversion do?

This thread has been viewed 1 times
  • 1.  What does the NwaNormalizeEmail conversion do?

    Posted Jul 11, 2018 11:55 PM

    In Aruba ClearPass Guest Management, when customizing a form field (in this case, my sponsor_email field) I have a need to ensure that there is nothing malicious about the email entered prior to perofrming the LDAP validation.

     

    I have chosen to use the NwaNormalizeEmail conversion in the advanced section, but there is nothing in the Guest User Guide that tells me what this actually does.  It talks about how it normalizes a phone number with NwaNormalizePhoneNumber but makes no mention of what NwaNormalizeEmail operates.

     

    Can someone clarify this?

     

    And, to be clear, I do NOT want to use the email validator to validate the email against RFC822.  I am using the isValidEmail validator with a do_ldap_lookup param to perform an LDAP lookup.  



  • 2.  RE: What does the NwaNormalizeEmail conversion do?

    EMPLOYEE
    Posted Jul 12, 2018 09:12 AM

    What do you mean by "nothing malicious" about the email?



  • 3.  RE: What does the NwaNormalizeEmail conversion do?

    Posted Jul 12, 2018 03:15 PM
    Like an LDAP injection attempt? Or perhaps some kind of DoS attempt?


  • 4.  RE: What does the NwaNormalizeEmail conversion do?

    EMPLOYEE
    Posted Jul 19, 2018 11:53 AM

    From the horse's mouth:

     

    /**

    * Strips common fluff out of an email.  Not meant as a validator nor to be perfect. 

    * Bad input should still be flagged. 

    *  " name@address.com   " => Kill surrounding whitespace

    *  "mailto:name@address.com" => Kill 'mailto:'

    *  "name@address.com;" => Kill trailing delimiters ';'

    *  "First Last <name@address.com>" => Kill name wrapper

    * @see IsValidEmail

    */



  • 5.  RE: What does the NwaNormalizeEmail conversion do?

    Posted Jul 19, 2018 02:24 PM
    Would it be safe to say it will protect against LDAP injection as per my case posted?