LDAP Injection (ARCH6107)

Key ruby.security.ldap-injection · Severity error · Category security · CWE CWE-90

Building LDAP filters from unescaped user input allows filter manipulation and authentication bypass. Always escape filter values.

Incorrect

require "net/ldap"

filter = Net::LDAP::Filter.construct("(uid=#{params[:user]})")
ldap.search(filter: filter)

Correct

require "net/ldap"

filter = Net::LDAP::Filter.eq("uid", params[:user])
ldap.search(filter: filter)

Fix

Use parameterized filter builders such as Net::LDAP::Filter.eq instead of string concatenation.