Downloads:
Back to the previous page
| Test Case ID |  148750 |
| Bad / Good / Mixed | Mixed |
| Author | |
| Associations | |
| Added by | SAMATE Team Staff |
| Language | Java |
| Type of test case | Source Code |
| Input string | |
| Expected Output | |
| Instructions | |
| Submission date | 2013-05-22 |
| Description | CWE: 90 LDAP Injection BadSource: getQueryString_Servlet Parse id param out of the URL query string (without using getParameter()) GoodSource: A hardcoded string BadSink: data concatenated into LDAP search, which could result in LDAP Injection Flow Variant: 41 Data flow: data passed as an argument from one method to another in the same class |
| File(s) |
|
| Flaw |
There are no comments
Have any comments on this test case? Please,
.
- IO.java
- AbstractTestCaseServlet.java
- AbstractTestCaseServletBase.java
- CWE90_LDAP_Injection__getQueryString_Servlet_41.java
File Contains:
CWE-090: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') on line(s): 91
CWE-090: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') on line(s): 91