Back to the previous page

Test Case ID	148753
Bad / Good / Mixed	Mixed
Author
Associations	Test suite: 87 109
Added by	SAMATE Team Staff
Language	Java
Type of test case	Source Code
Input string
Expected Output
Instructions
Submission date	2013-05-22
Description	CWE: 90 LDAP Injection BadSource: getQueryString_Servlet Parse id param out of the URL query string (without using getParameter()) GoodSource: A hardcoded string BadSink: data concatenated into LDAP search, which could result in LDAP Injection Flow Variant: 51 Data flow: data passed as an argument from one function to another in different classes in the same package
File(s)	servlet-api.jar (86.16 kB) IO.java (3.34 kB) AbstractTestCaseServlet.java (3.39 kB) AbstractTestCaseServletBase.java (3.5 kB) CWE90_LDAP_Injection__getQueryString_Servlet_51a.java (2.71 kB) CWE90_LDAP_Injection__getQueryString_Servlet_51b.java (4.98 kB)
Flaw	CWE-090: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') • 1

There are no comments

Have any comments on this test case? Please, .

File Contains:
CWE-090: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') on line(s): 33