Autodesk / Autodesk/jira-ldap-group-sync-plugin
LDAP Injection
- Dominant language
- Java
- Stars
- 7
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
https://github.com/Autodesk/jira-ldap-group-sync-plugin/blob/310fcf48892cece812997afc8ebf2cc9f850d894/src/main/java/com/adsk/jira/ldapgroupsync/plugin/api/LDAPGroupSyncUtilImpl.java#L179-L186
Constructing a dynamic LDAP filter with user input could allow an attacker to modify the statement's meaning.
Contributor guide
Research direction
Start by inspecting lines 179–186 of src/main/java/com/adsk/jira/ldapgroupsync/plugin/api/LDAPGroupSyncUtilImpl.java, focusing on how user input is incorporated into the dynamic LDAP filter. Confirm the filter cannot be altered through crafted input, then run the project's relevant tests and add coverage for the injection case if the existing test suite has a suitable location.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100