Escape LDAP filter chars

devpi / devpi-ldap

Plugin for devpi-server which provides LDAP authentication.

36 stars 20 forks source link

Escape LDAP filter chars #40

Open stroeder opened 6 years ago

stroeder commented 6 years ago

Your module is prone to LDAP injection attacks. You should properly escape special LDAP filter chars in user's input probably in method LDAP._search().

fschulze commented 6 years ago

Help with this is appreciated. Especially raw example data which can be used in tests.