File tree Expand file tree Collapse file tree 1 file changed +3
-4
lines changed
python/ql/src/experimental/Security/CWE-287 Expand file tree Collapse file tree 1 file changed +3
-4
lines changed Original file line number Diff line number Diff line change 3
3
"qhelp.dtd">
4
4
<qhelp >
5
5
<overview >
6
- <p >If an LDAP query is built using string concatenation or string formatting, and it doesn't carry any kind of authentication,
7
- anonymous binds causes an empty or None-set password to result in a successful authentication.</p >
6
+ <p >If an LDAP query doesn't carry any kind of authentication, anonymous binds causes an empty or None-set password
7
+ to result in a successful authentication.</p >
8
8
</overview >
9
9
10
10
<recommendation >
11
11
<p >Use a strong password while establishing a LDAP connection to execute a query a user controls.</p >
12
12
</recommendation >
13
13
14
14
<example >
15
- <p >In the following examples, the code accepts both <code >username</code > and <code >dc</code > from the user,
16
- which it then uses to build a LDAP query and DN while the connection carries no authentication or binds anonymously.</p >
15
+ <p >In the following examples, the code builds a LDAP query whose execution carries no authentication or binds anonymously.</p >
17
16
18
17
<sample src =" examples/auth_bad_2.py" />
19
18
<sample src =" examples/auth_bad_3.py" />
You can’t perform that action at this time.
0 commit comments