False negative: py/ldap-injection misses taint flow for ldap3 `extend.standard.paged_search`
- Langage dominant
- CodeQL
- Étoiles
- 10.1k
- Forks
- 2.1k
- Merge moyen
- 2 j 15 h
- PR mergées (30 j)
- 141
Description
`py/ldap-injection` reports taint for `ldap3.Connection.search(...)`, but misses equivalent taint flow in:
`conn.extend.standard.paged_search(search_base=..., search_filter=...)`
```python
from flask import Flask, request
import ldap3
app = Flask(__name__)
@app.route("/paged")
def paged():
dn = "dc={}".format(request.args["dc"])
filt = "(user={})".format(request.args["username"])
conn = ldap3.Connection(ldap3.Server("ldap://127.0.0.1"), user=dn, auto_bind=True)
conn.extend.standard.paged_search(search_base=dn, search_filter=filt) # no alert
```
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Start with the py/ldap-injection query and compare how ldap3.Connection.search(...) models taint flow with the conn.extend.standard.paged_search(...) call shown here. The work is done when taint reaching search_base and search_filter through this API is reported equivalently to the existing search flow.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- python
- Domaine
- security
- Type d'issue
- Bug
- Difficulté
- 3/5
- Temps estimé
- 1-2 jours
- Activité
- Calme
- Clarté
- Plutôt claire
- Accessibilité débutants
- 68/100