Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

ID

scala.inject.scala_inject_rule_ldapinjection

Severity

low

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Inject

Language

Scala

Description

Just like SQL, all inputs passed to an LDAP query need to be passed in safely. Unfortunately, LDAP doesn’t have prepared statement interfaces like SQL. Therefore, the primary defense against LDAP injection is strong input validation of any untrusted data before including it in an LDAP query.

Rationale

Just like SQL, all inputs passed to an LDAP query need to be passed in safely. Unfortunately, LDAP doesn’t have prepared statement interfaces like SQL. Therefore, the primary defense against LDAP injection is strong input validation of any untrusted data before including it in an LDAP query.

The following code illustrates a vulnerable pattern detected by this rule:

class DirectoryQueries {
  @throws[NamingException]
  def fromTheCaller(template: LdapTemplate, supplied: String, controls: SearchControls, processor: DirContextProcessor): Unit = {
    // VULNERABLE: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
    template.list(supplied)
    // VULNERABLE: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
    template.list(supplied, new DefaultNameClassPairMapper)
    // VULNERABLE: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
    template.list(supplied, new CountNameClassPairCallbackHandler)
    // VULNERABLE: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
    template.lookup(supplied)
    val mapper = new DefaultIncrementalAttributesMapper("")
    // VULNERABLE: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
    template.lookup(supplied, mapper)
    // VULNERABLE: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
    template.lookup(supplied, mapper)
    // VULNERABLE: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
    template.search(supplied, "dn=1", controls, mapper)
    // VULNERABLE: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
    template.search(supplied, "dn=1", controls, mapper, processor)
    // VULNERABLE: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
    template.search(supplied, "dn=1", controls, mapper, processor)
    // VULNERABLE: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
    template.search(supplied, "dn=1", controls, mapper, processor)
    // VULNERABLE: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
    template.search(supplied, "dn=1", mapper)
    // VULNERABLE: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
    template.search(supplied, "dn=1", SearchControls.OBJECT_SCOPE, new Array[String](0), mapper)
    // VULNERABLE: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
    template.search(supplied, "dn=1", SearchControls.OBJECT_SCOPE, mapper)
    // VULNERABLE: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
    template.search(supplied, "dn=1", mapper)
  }

  @throws[NamingException]
  def fromAConstant(template: LdapTemplate, controls: String, processor: DirContextProcessor): Unit = {
    val base = "uid=service"
    template.list(base)
    template.list(base, new DefaultNameClassPairMapper)
    template.list(base, new CountNameClassPairCallbackHandler())
    template.lookup(base)
    val mapper = new DefaultIncrementalAttributesMapper("")
    template.lookup(base, mapper)
    template.lookup(base, mapper)
  }
}

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References

© 2026 Xygeni. All rights reserved