Skip to content

False negative: py/ldap-injection misses taint flow for ldap3 extend.standard.paged_search #21738

@9iang22

Description

@9iang22

py/ldap-injection reports taint for ldap3.Connection.search(...), but misses equivalent taint flow in:
conn.extend.standard.paged_search(search_base=..., search_filter=...)

from flask import Flask, request
import ldap3
app = Flask(__name__)
@app.route("/paged")
def paged():
    dn = "dc={}".format(request.args["dc"])
    filt = "(user={})".format(request.args["username"])
    conn = ldap3.Connection(ldap3.Server("ldap://127.0.0.1"), user=dn, auto_bind=True)
    conn.extend.standard.paged_search(search_base=dn, search_filter=filt)  # no alert

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions