{"action":"closed","issue":{"url":"https://api.github.com/repos/dzone/osqa/issues/87","labels_url":"https://api.github.com/repos/dzone/osqa/issues/87/labels{/name}","comments_url":"https://api.github.com/repos/dzone/osqa/issues/87/comments","events_url":"https://api.github.com/repos/dzone/osqa/issues/87/events","html_url":"https://github.com/dzone/osqa/issues/87","id":64968228,"number":87,"title":"Potential LDAP injection","user":{"login":"kost","id":68575,"avatar_url":"https://avatars.githubusercontent.com/u/68575?v=3","gravatar_id":"","url":"https://api.github.com/users/kost","html_url":"https://github.com/kost","followers_url":"https://api.github.com/users/kost/followers","following_url":"https://api.github.com/users/kost/following{/other_user}","gists_url":"https://api.github.com/users/kost/gists{/gist_id}","starred_url":"https://api.github.com/users/kost/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kost/subscriptions","organizations_url":"https://api.github.com/users/kost/orgs","repos_url":"https://api.github.com/users/kost/repos","events_url":"https://api.github.com/users/kost/events{/privacy}","received_events_url":"https://api.github.com/users/kost/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/dzone/osqa/labels/b4migration","name":"b4migration","color":"c7def8"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-03-28T17:34:44Z","updated_at":"2015-05-09T15:45:09Z","closed_at":"2015-05-09T15:45:09Z","body":"There's potential LDAP injection in:\r\nforum_modules/ldapauth/authentication.py\r\n\r\nAs request is taken directly from parameters:\r\n      username = request.POST['username'].strip()\r\n        password = request.POST['password']\r\n        uid = str(settings.LDAP_USER_MASK) % username\r\n\r\nAnd then added to search_s without any sanitization:\r\nsearch = ldapo.search_s(str(settings.LDAP_BASE_DN), ldap.SCOPE_SUBTREE, uid)\r\n\r\nAnyway, anything in this authentication.py file is done like that (without sanitization)...\r\n"}}