Skip to content

Fix LDAP filter injection in benchmark case 44 - #18

Open
fgibelin wants to merge 1 commit into
masterfrom
fgibelin-fix-ldap-injection-alert-97
Open

fgibelin wants to merge 1 commit into
masterfrom
fgibelin-fix-ldap-injection-alert-97

Conversation

@fgibelin

@fgibelin fgibelin commented Nov 2, 2026

Copy link
Copy Markdown
Owner

Benchmark case 44 interpolated the request UID directly into an LDAP search filter, allowing filter metacharacters to alter the query. This encodes the UID as LDAP filter data, adds regression tests for ordinary and metacharacter input, and updates only case 44's expected result.

Validation: mvn -q -Dspotless.apply.skip=true -Dtest=LDAPManagerTest test passes. The configured Spotless formatter could not run because google-java-format 1.17.0 is incompatible with the installed JDK 27.

Encode the UID as LDAP filter data and update the case expectation with focused regression coverage.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant