René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Python] CWE-090: LDAP Injection ","articleBody":"## Query\r\n\r\nhttps://github.com/github/codeql/pull/5443\r\n\r\n## Report\r\n\r\nConstructing LDAP names or search filters directly from tainted data enables attackers to inject specially crafted values that changes the initial meaning of the name or filter itself. Successful LDAP injections attacks can read, modify or delete sensitive information from the directory service.\r\n\r\nThis query identifies cases in which a LDAP query executes user-provided input without being sanitized before.\r\n\r\n- [x] Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). *We would love to have you spread the word about the good work you are doing*\r\n\r\n## Result(s)\r\n\r\n- PRs providing fix:\r\n- - https://github.com/cernanalysispreservation/analysispreservation.cern.ch/pull/2180\r\n- - https://github.com/UCL-INGI/INGInious/pull/662\r\n- - https://github.com/LibrIT/passhport/pull/562\r\n- - https://github.com/getredash/redash/pull/5441\r\n- - https://github.com/abcdabcd987/lxc-gpu/pull/4\r\n","author":{"url":"https://github.com/jorgectf","@type":"Person","name":"jorgectf"},"datePublished":"2021-03-18T16:33:26.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":6},"url":"https://github.com/319/securitylab/issues/319"}