LDAP injection (ARCH3107)

Key typescript.security.ldap-injection · Severity error · Category security · CWE CWE-90

Building LDAP search filters from unescaped user input allows filter manipulation and authentication bypass. Always escape filter values.

Incorrect

const filter = `(uid=${req.body.username})`;
client.search("ou=users,dc=example,dc=com", { filter }, cb);

Correct

import { filters } from "ldap-escape";

const filter = filters`(uid=${req.body.username})`;
client.search("ou=users,dc=example,dc=com", { filter }, cb);

Fix

Sanitize user values that enter the filter with an LDAP escaping library; never use string concatenation.