Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

  package main
  
  import (
      "fmt"
      "net/http"
      "github.com/go-ldap/ldap/v3"
  )
  
  func handler(w http.ResponseWriter, r *http.Request) {
      username := r.FormValue("username")
-     // Vulnerable: user input in LDAP filter
-     filter := fmt.Sprintf("(&(uid=%s)(objectClass=person))", username)
+     // Safe: escape special LDAP filter characters
+     escaped := ldap.EscapeFilter(username)
+     filter := fmt.Sprintf("(&(uid=%s)(objectClass=person))", escaped)
      searchRequest := ldap.NewSearchRequest(
          "dc=example,dc=com",
          ldap.ScopeWholeSubtree, ldap.NeverDerefAliases,
          0, 0, false, filter, []string{"dn", "cn"}, nil,
      )
      result, _ := conn.Search(searchRequest)
  }
  

  const express = require('express');
  const ldap = require('ldapjs');
  const app = express();
  
- app.post('/login', (req, res) => {
-   const username = req.body.username;
+ function escapeLDAP(str) {
+   return str.replace(/[\\*()\\x00]/g, c =>
+     '\\' + c.charCodeAt(0).toString(16).padStart(2, '0'));
+ }
+ 
+ app.post('/login', (req, res) => {
+   const username = escapeLDAP(req.body.username);
    const filter = `(&(uid=${username})(objectClass=person))`;
    client.search('dc=example,dc=com', { filter }, (err, result) => {
      res.json(result);
    });
  });
  

  import ldap
- from flask import request
- 
- @app.route('/search')
- def search():
-     username = request.args.get('username')
-     conn = ldap.initialize('ldap://localhost')
-     filter_str = f"(uid={username})"
+ from ldap.filter import escape_filter_chars
+ from flask import request
+ 
+ @app.route('/search')
+ def search():
+     username = request.args.get('username', '')
+     safe_username = escape_filter_chars(username)
+     conn = ldap.initialize('ldap://localhost')
+     filter_str = f"(uid={safe_username})"
      results = conn.search_s('dc=example,dc=com', ldap.SCOPE_SUBTREE, filter_str)
      return str(results)