이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Metadata

ID: csharp-security/ldap-injection

Language: C#

Severity: Warning

Category: Security

CWE: 90

Description

Unvalidated user inputs may lead to LDAP injection. Always escape characters in your LDAP queries. Do not build LDAP queries manually.

Learn More

Non-Compliant Code Examples

public class MyController : Controller
{
    public bool userExists(string user, string pass)
    {
        DirectoryEntry directory  = new DirectoryEntry();
        DirectorySearcher directorySearch  = new DirectorySearcher(directory);

        directorySearch.Filter = "(&(uid=" + user + ")(userPassword=" + pass + "))";

        return directorySearch.FindOne() != null;
    }
}
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Analysis