danog/psalm
1
0
Fork 0
mirror of https://github.com/danog/psalm.git synced 2024-11-30 04:39:00 +01:00
Code Issues Projects Releases Wiki Activity
master
psalm/docs/running_psalm/issues/TaintedLdap.md
Lukas Reschke ce05165384
Split LDAP into custom category (#4604) 
- Adds ldap_escape as sanitizer
- Defines the right parameters to ldap_search as sink
- Wrote documentation
- Added tests
2021-01-29 11:46:14 +01:00

1023 B
Raw Permalink Blame History

TaintedLdap

Potential LDAP injection. This rule is emitted when user-controlled input can be passed into a LDAP request.

Risk

Passing untrusted user input to LDAP requests could be dangerous.

If LDAP requests like these are used for login purposes, it could result in an authentication bypass. An attacker could write a filter that would evaluate to true for any user, and thus bruteforce credentials easily.

Example

<?php

$ds = ldap_connect('example.com');
$dn = 'o=Psalm, c=US';
$filter = $_GET['filter']);
ldap_search($ds, $dn, $filter, []);

Mitigations

Use ldap_escape to escape user input to the LDAP filter and DN.

Further resources