Improperly implemented security check for standard

object DirectoryLookup {
  private val directoryUrl = "ldaps://directory.internal/dc=directory,dc=internal"
  private val factory = "com.sun.jndi.ldap.LdapCtxFactory"

  @throws[Exception]
  private def connect(environment: Hashtable[String, String]) = {
    environment.put(Context.INITIAL_CONTEXT_FACTORY, factory)
    environment.put(Context.PROVIDER_URL, directoryUrl)
    // VULNERABLE: Improperly implemented security check for standard
    environment.put(Context.SECURITY_AUTHENTICATION, "none")
    new InitialDirContext(environment)
  }

  // Binding with a principal is the control: only "none" is anonymous.
  @throws[Exception]
  def bind(dn: String, secret: String): Boolean = {
    val environment = new Hashtable[String, String]
    environment.put(Context.SECURITY_AUTHENTICATION, "simple")
    environment.put(Context.SECURITY_PRINCIPAL, dn)
    environment.put(Context.SECURITY_CREDENTIALS, secret)
    try connect(environment)
    catch {
      case e: javax.naming.AuthenticationException =>
        return false
    }
    true
  }
}