LDAP injection (ARCH2107)

Key python.security.ldap-injection · Severity error · Category security · CWE CWE-90

Building LDAP search filters from unescaped user input lets an attacker manipulate the filter to bypass authentication or reach unauthorized data.

Incorrect

def find_user(conn, username):
    flt = f"(uid={username})"
    conn.search("ou=people,dc=example,dc=com", flt)

Correct

from ldap3.utils.conv import escape_filter_chars

def find_user(conn, username):
    flt = f"(uid={escape_filter_chars(username)})"
    conn.search("ou=people,dc=example,dc=com", flt)

Fix

Escape filter values with escape_filter_chars; never embed raw user input in the filter.