Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Missing taint sinks for LDAP Injection #105

Closed
h3xstream opened this issue Oct 8, 2015 · 3 comments · Fixed by #115
Closed

Missing taint sinks for LDAP Injection #105

h3xstream opened this issue Oct 8, 2015 · 3 comments · Fixed by #115
Assignees
@h3xstream
Labels
enhancement New feature or improvement to existing detector.
Milestone
version-1.4.4

Comments

@h3xstream
Copy link
Member

Add coverage for the method search for DirContext

Thanks to @mcwww for the information
@h3xstream h3xstream added the enhancement New feature or improvement to existing detector. label Oct 8, 2015
@h3xstream h3xstream added this to the version-1.4.4 milestone Oct 8, 2015
@h3xstream h3xstream self-assigned this Oct 8, 2015
@formanek
Copy link
Contributor

formanek commented Oct 9, 2015

It seems to be already included in JndiLdapInjectionSource.

@h3xstream
Copy link
Member Author

@formanek My mistake. The missing API was actually lookup().
Ref: OWASP LDAP Injection

@h3xstream
Copy link
Member Author

Note: I will not add any new signature until the refactoring on taint detector is completed. #96

@h3xstream h3xstream changed the title LDAP Injection Missing taint sinks for LDAP Injection Oct 17, 2015
@formanek formanek mentioned this issue Oct 18, 2015
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@h3xstream h3xstream

Labels
enhancement New feature or improvement to existing detector.
Projects
None yet
Milestone
version-1.4.4
Development

Successfully merging a pull request may close this issue.

Refactored and fixed injection detectors formanek/find-sec-bugs
2 participants
@h3xstream @formanek