Back to the previous page

Test Case ID	123326
Bad / Good / Mixed	Mixed
Author	NSA/Center for Assured Software
Associations	Test suite: 86 108
Added by	Charles Oliveira
Language	C
Type of test case	Source Code
Input string
Expected Output
Instructions
Submission date	2013-05-21
Description	CWE: 90 LDAP Injection BadSource: listen_socket Read data using a listen socket (server side) GoodSource: Use a fixed string Sinks: BadSink : data concatenated into LDAP search, which could result in LDAP Injection Flow Variant: 84 Data flow: data passed to class constructor and destructor by declaring the class object on the heap and deleting it after use
File(s)	CWE90_LDAP_Injection__w32_wchar_t_listen_socket_84.h (1.31 kB) CWE90_LDAP_Injection__w32_wchar_t_listen_socket_84_bad.cpp (5.75 kB) CWE90_LDAP_Injection__w32_wchar_t_listen_socket_84_goodG2B.cpp (3.02 kB) CWE90_LDAP_Injection__w32_wchar_t_listen_socket_84a.cpp (2.3 kB) io.c (5.3 kB) std_testcase.h (3.91 kB) std_testcase_io.h (1.42 kB)
Flaw	CWE-090: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') • 1

There are no comments

Have any comments on this test case? Please, .

File Contains:
CWE-090: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') on line(s): 154