Back to the previous page

Test Case ID	148747
Bad / Good / Mixed	Mixed
Author
Associations	Test suite: 87 109
Added by	SAMATE Team Staff
Language	Java
Type of test case	Source Code
Input string
Expected Output
Instructions
Submission date	2013-05-22
Description	CWE: 90 LDAP Injection BadSource: getQueryString_Servlet Parse id param out of the URL query string (without using getParameter()) GoodSource: A hardcoded string Sinks: BadSink : data concatenated into LDAP search, which could result in LDAP Injection Flow Variant: 21 Control flow: Flow controlled by value of a private variable. All functions contained in one file.
File(s)	CWE90_LDAP_Injection__getQueryString_Servlet_21.java (10.73 kB) IO.java (3.34 kB) AbstractTestCaseServlet.java (3.39 kB) AbstractTestCaseServletBase.java (3.5 kB) servlet-api.jar (86.16 kB)
Flaw	CWE-090: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') • 2

There are no comments

Have any comments on this test case? Please, .

File Contains:
CWE-090: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') on line(s): 52, 100