no-ldap-injection

CWE: CWE-74
OWASP Mobile: OWASP Mobile Top 10

Detects LDAP injection vulnerabilities. This rule is part of eslint-plugin-secure-coding.

💼 This rule is set to error in the recommended config.

Quick SummaryCopy Anchor Link

Vulnerability and RiskCopy Anchor Link

Vulnerability: LDAP Injection allows attackers to modify LDAP statements by supplying malicious input that is not properly sanitized or escaped.

Risk: Attackers can alter LDAP queries to bypass authentication (e.g., logging in as any user), leak sensitive directory information (like emails, phone numbers, or passwords), or in some cases, modify user attributes.

Rule DetailsCopy Anchor Link

LDAP injection occurs when user input is improperly inserted into LDAP queries, allowing attackers to:

• Bypass authentication and authorization
• Extract sensitive directory information (users, groups, passwords)
• Perform unauthorized LDAP operations
• Enumerate users through blind injection techniques

Why This MattersCopy Anchor Link

ExamplesCopy Anchor Link

❌ IncorrectCopy Anchor Link

// String interpolation in LDAP filter
const filter = `(uid=${username})`;
ldapClient.search('ou=users,dc=example,dc=com', { filter });

// String concatenation
const searchFilter = '(cn=' + userInput + ')';

// Template literal with untrusted input
const ldapFilter = `(&(objectClass=user)(mail=${email}))`;

✅ CorrectCopy Anchor Link

const filter = `(uid=${ldap.escape.filterValue(userId)})`;

What the rule judgesCopy Anchor Link

Nothing is examined unless the file loads an LDAP client (ldapPackages / additionalLdapPackages). Within such a file:

• A built filter — a template literal, a + concatenation (including a conditional choosing between two), or a binding written once with one — is reported (unsafeLdapFilter) when its static text is filter grammar ((attr=, (attr~=, (attr>=, …) and a part of it is neither a constant this file wrote nor passed through a configured escape or validation function.
• Request data handed over whole — req.query.f, a name bound to it, an { filter: … } option carrying it (the key may be filter, 'filter', ['filter'] or a constant bound to 'filter'), or a helper given it in any argument, spread included — is reported (unescapedLdapInput).
• A distinguished name built from a dynamic part, or taken from the request, is reported (ldapInjection); a DN concatenated from constants is not.
• A hardcoded match-everything filter — one ending in a wildcard ((uid=*)), the absolute-true (&), *|*, *&* — is reported (dangerousLdapOperation). The absolute-false (|) matches nothing and is not; a ! inside an assertion value is a literal character; a number concatenated into the filter is part of its text.
• A receiver that is provably not an LDAP client — every write to its binding (or its class field's initialiser) is a collection, a literal, or a call/new not made from an LDAP import — is skipped, so set.add(…) is not an LDAP add. A receiver bound to an unknown name is not provably anything and stays in view.

ConfigurationCopy Anchor Link

{
  rules: {
    'secure-coding/no-ldap-injection': ['error', {
      ldapFunctions: ['search', 'bind', 'modify', 'add', 'delete'],
      ldapEscapeFunctions: ['escape.filterValue', 'escape.dnValue'],
      ldapValidationFunctions: ['validateLdapInput', 'sanitizeLdapFilter']
    }]
  }
}

OptionsCopy Anchor Link

Error Message FormatCopy Anchor Link

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

🔒 CWE-90 OWASP:A05 CVSS:9.8 | LDAP Injection detected | CRITICAL
   Fix: Review and apply the recommended fix | https://owasp.org/Top10/A05_2021/

Message ComponentsCopy Anchor Link

Known False NegativesCopy Anchor Link

The following patterns are not detected due to static analysis limitations:

Query from VariableCopy Anchor Link

Why: Query strings from variables not traced.

// ❌ NOT DETECTED - Query from variable
const query = `SELECT * FROM users WHERE id = ${userId}`;
db.execute(query);

Mitigation: Always use parameterized queries.

Custom Query BuildersCopy Anchor Link

Why: Custom ORM/query builders not recognized.

// ❌ NOT DETECTED - Custom builder
customQuery.where(userInput).execute();

Mitigation: Review all query builder patterns.

Template EnginesCopy Anchor Link

Why: Template-based queries not analyzed.

// ❌ NOT DETECTED - Template
executeTemplate('query.sql', { userId });

Mitigation: Validate all template variables.

Further ReadingCopy Anchor Link

• OWASP LDAP Injection - Attack documentation
• CWE-90 - Official CWE entry
• ldapjs Security - Safe LDAP filter construction

Related RulesCopy Anchor Link

• no-sql-injection - SQL injection prevention
• no-xpath-injection - XPath injection prevention

Use this rule

npm install -D oxlint-plugin-secure-coding

{  "jsPlugins": ["oxlint-plugin-secure-coding"],  "rules": {    "secure-coding/no-ldap-injection": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-secure-coding'],    rules: {      'secure-coding/no-ldap-injection': 'error',    },  },});