sdk/python/Databases/PyLdap3

PyLdap3

ldap3 is a pure-Python LDAP client. Connection.search() accepts a search_filter — LDAP injection sink when the filter is built from user input without escaping. Use ldap3.utils.conv.escape_filter_chars() for safe construction.

1 sink

Taint flow0 sources → 1 sink

Sinks — dangerous call

.search()Runs an LDAP search

Sinks

— dangerous functions taint must not reach

.search()Sink

Signature

Connection.search(search_base, search_filter, search_scope=SUBTREE, ...) -> bool

Runs an LDAP search. Injection sink when search_filter is built from user input.

tracks:1

Other Methods

.Connection()Neutral

Signature

ldap3.Connection(server, user=None, password=None, ...) -> Connection

Creates an LDAP connection.

.bind()Neutral

Signature

Connection.bind() -> bool

Binds / authenticates. Neutral.

Fully-Qualified Names

FQN	Field
ldap3	fqns[0]
ldap3.Connection	fqns[1]

Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.

Import

rule.py

from codepathfinder.go_rule import PyLdap3

← PreviousPyIbmDb

Next →PyMysqlDb