Skip to content

Fix/ldap levels feedback#539

Merged
preetkaran20 merged 7 commits intoSasanLabs:masterfrom
antriksh-9:fix/ldap-levels-feedback
Mar 25, 2026
Merged

Fix/ldap levels feedback#539
preetkaran20 merged 7 commits intoSasanLabs:masterfrom
antriksh-9:fix/ldap-levels-feedback

Conversation

@antriksh-9
Copy link
Contributor

@antriksh-9 antriksh-9 commented Mar 23, 2026

  • improved controller logic in level 3 and level 5 vulnerability
  • replaced "User Search" with "Login" at both buttonText and form header in level 3, level 5 and level 6.

completes: #526
fixes: #517

@codecov-commenter
Copy link

codecov-commenter commented Mar 23, 2026

Codecov Report

❌ Patch coverage is 61.90476% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 51.52%. Comparing base (dd4f48f) to head (2e9eb14).

Files with missing lines Patch % Lines
...lity/ldapInjection/LDAPInjectionVulnerability.java 61.90% 4 Missing and 4 partials ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##             master     #539      +/-   ##
============================================
+ Coverage     51.48%   51.52%   +0.03%     
  Complexity      420      420              
============================================
  Files            65       65              
  Lines          2451     2467      +16     
  Branches        256      261       +5     
============================================
+ Hits           1262     1271       +9     
- Misses         1079     1082       +3     
- Partials        110      114       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

</div>

<button id="searchBtn">Search User</button>
<button id="searchBtn">Login</button>
Copy link
Member

@preetkaran20 preetkaran20 Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ldap subtitle on line 4 above is still search user ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My bad - I've updated the subtitle for each level.

element.classList.remove("hidden");
}

function getSubtitleForLevel(url) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of relying on URL, use method called getCurrentVulnerabilityLevel. it will provide the level of vulnerability.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've used vulnerabilityLevelSelected instead of getCurrentVulnerabilityLevel as it was resulting in undefined.

if (url.includes("LEVEL_4")) {
return "Search sanitized user input using LDAP filter.";
}
if (url.includes("LEVEL_5")) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Better to create small json object config and use it instead of if/else.

level_config=
{
LEVEL_1 : "",
LEVEL_2: ""
}

document.getElementById("ldapSubtitle").textContent = subtitle;

if (
url.includes("LEVEL_1") ||
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This if can also move to config

@preetkaran20
Copy link
Member

Overall looks good. can you please change the if/else in js file to config in the same js file and derive logic as that is better and easier to maintain.

@preetkaran20
Copy link
Member

Overall, PR looks good and is ready to merge once the config change is done. Thanks a lot for all the effort @antriksh-9

@antriksh-9 antriksh-9 force-pushed the fix/ldap-levels-feedback branch from a1241ed to 4a55f4b Compare March 24, 2026 15:06
@antriksh-9 antriksh-9 force-pushed the fix/ldap-levels-feedback branch from 4a55f4b to 2e9eb14 Compare March 24, 2026 15:09
@antriksh-9 antriksh-9 requested a review from preetkaran20 March 25, 2026 16:33
Copy link
Member

@preetkaran20 preetkaran20 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Amazing work @antriksh-9 ❤️ Merging it now.

@preetkaran20 preetkaran20 merged commit c857f60 into SasanLabs:master Mar 25, 2026
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Implement LDAP Injection Vulnerability

3 participants