LDAP Injection
Description
Detects LDAP queries constructed with unsanitized user input.
How to fix
Escape LDAP special characters using escape_filter_chars(). ```python from ldap3.utils.conv import escape_filter_chars safe_username = escape_filter_chars(username) ``` Learn more: https://shoulder.dev/learn/python/cwe-90/ldap-injection
Applies to
Languages
Frameworks
django
flask
fastapi
pyramid
tornado
References
Scan for this issue
Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=python-ldap-injection .