Skip to content

Commit 2f9e645

Browse files
committed
Hardcode ldap2 binding functions
1 parent 1d432af commit 2f9e645

File tree

1 file changed

+16
-2
lines changed
  • python/ql/src/experimental/semmle/python/frameworks

1 file changed

+16
-2
lines changed

python/ql/src/experimental/semmle/python/frameworks/LDAP.qll

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,16 +68,30 @@ private module LDAP {
6868
}
6969
}
7070

71+
/**
72+
* List of `ldap` methods used for binding.
73+
*
74+
* See https://www.python-ldap.org/en/python-ldap-3.3.0/reference/ldap.html#functions
75+
*/
76+
private class LDAP2BindMethods extends string {
77+
LDAP2BindMethods() {
78+
this in [
79+
"bind", "bind_s", "simple_bind", "simple_bind_s", "sasl_interactive_bind_s",
80+
"sasl_non_interactive_bind_s", "sasl_external_bind_s", "sasl_gssapi_bind_s"
81+
]
82+
}
83+
}
84+
7185
/** Gets a reference to a `ldap` bind. */
7286
private DataFlow::Node ldapBind() {
7387
result = ldapOperation() and
74-
result.(DataFlow::AttrRead).getAttributeName().matches("%bind%")
88+
result.(DataFlow::AttrRead).getAttributeName() instanceof LDAP2BindMethods
7589
}
7690

7791
/**
7892
* A class to find `ldap` methods binding a connection.
7993
*
80-
* See `LDAP2QueryMethods`
94+
* See `LDAP2BindMethods`
8195
*/
8296
private class LDAP2Bind extends DataFlow::CallCfgNode, LDAPBind::Range {
8397
LDAP2Bind() { this.getFunction() = ldapBind() }

0 commit comments

Comments
 (0)