LDAP Injection (ARCH4107)

Key java.security.ldap-injection · Severity error · Category security · CWE CWE-90

Building LDAP search filters by concatenating unescaped user input allows filter manipulation and authentication bypass. Pass input through LDAP filter escaping.

Incorrect

String filter = "(uid=" + request.getParameter("user") + ")"; // unescaped
NamingEnumeration<SearchResult> r = ctx.search("ou=people", filter, controls);

Correct

String filter = "(uid={0})";
Object[] args = { request.getParameter("user") }; // bound arg is escaped
NamingEnumeration<SearchResult> r = ctx.search("ou=people", filter, args, controls);

Fix

Pass values as bound arguments or apply filter escaping in LDAP filters; do not concatenate strings.