LDAP Injection discussion should provide an example of "fixed" code
- Dominant language
- No language data
- Stars
- 4.8k
- Forks
- 6.1k
- Avg merge
- 15h 21m
- Merged PRs (30d)
- 370
Description
This document shows an example of a violation, but it does not provide a "fixed" example.
Ideally, we should see an example of manual filtering (perhaps with a Regular Expression) and an example of a parameterized LDAP query (like using `SqlCommand` and `SqlParameter` for a db query).
I'm here for the example of a parameterized LDAP query because I cannot find the name of the classes that should be used in C# (and the web is full of junk answers).
And one other comment... The page only shows developers how to stop analyzing for this finding. I think that's a poor choice. The docs should show a developer how to fix the finding, not how to turn the analyzer off. Developers can get the poor answers on Stack Overflow, if they are inclined.
In case it helps, here is the page I was on: https://docs.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca3005 . I landed there while searching for "C# parameterized LDAP query" (without the quotes).
---
#### Document Details
⚠ *Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.*
* ID: 3b948905-1c32-6e0a-3113-676deb3f8397
* Version Independent ID: 029c7fa0-678d-87aa-a93d-6a26ea8c278f
* Content: [CA3005: Review code for LDAP injection vulnerabilities (code analysis) - .NET](https://docs.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca3005)
* Content Source: [docs/fundamentals/code-analysis/quality-rules/ca3005.md](https://github.com/dotnet/docs/blob/main/docs/fundamentals/code-analysis/quality-rules/ca3005.md)
* Product: **dotnet-fundamentals**
* GitHub Login: @dotpaul
* Microsoft Alias: **paulming**
Contributor guide
Assessment
This issue has not been assessed yet.