github / github/codeql

False negative: py/ldap-injection misses taint flow for ldap3 `extend.standard.paged_search`

Open
#21,738 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

`py/ldap-injection` reports taint for `ldap3.Connection.search(...)`, but misses equivalent taint flow in:
`conn.extend.standard.paged_search(search_base=..., search_filter=...)`

```python
from flask import Flask, request
import ldap3
app = Flask(__name__)
@app.route("/paged")
def paged():
dn = "dc={}".format(request.args["dc"])
filt = "(user={})".format(request.args["username"])
conn = ldap3.Connection(ldap3.Server("ldap://127.0.0.1"), user=dn, auto_bind=True)
conn.extend.standard.paged_search(search_base=dn, search_filter=filt) # no alert
```

Contributor guide

Open the contributing guide

Research direction

Start with the py/ldap-injection query and compare how ldap3.Connection.search(...) models taint flow with the conn.extend.standard.paged_search(...) call shown here. The work is done when taint reaching search_base and search_filter through this API is reported equivalently to the existing search flow.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.