/* TEMPLATE GENERATED TESTCASE FILE Filename: CWE90_LDAP_Injection__w32_wchar_t_listen_socket_54b.c Label Definition File: CWE90_LDAP_Injection__w32.label.xml Template File: sources-sink-54b.tmpl.c */ /* * @description * CWE: 90 LDAP Injection * BadSource: listen_socket Read data using a listen socket (server side) * GoodSource: Use a fixed string * Sink: * BadSink : data concatenated into LDAP search, which could result in LDAP Injection * Flow Variant: 54 Data flow: data passed as an argument from one function through three others to a fifth; all five functions are in different source files * * */ #include "std_testcase.h" #ifdef _WIN32 #include #include #include #pragma comment(lib, "ws2_32") /* include ws2_32.lib when linking */ #define CLOSE_SOCKET closesocket #else #include #include #include #include #include #define INVALID_SOCKET -1 #define SOCKET_ERROR -1 #define CLOSE_SOCKET close #define SOCKET int #endif #define TCP_PORT 27015 #define LISTEN_BACKLOG 5 #include #pragma comment(lib, "wldap32") /* all the sinks are the same, we just want to know where the hit originated if a tool flags one */ #ifndef OMITBAD /* bad function declaration */ void CWE90_LDAP_Injection__w32_wchar_t_listen_socket_54c_badSink(wchar_t * data); void CWE90_LDAP_Injection__w32_wchar_t_listen_socket_54b_badSink(wchar_t * data) { CWE90_LDAP_Injection__w32_wchar_t_listen_socket_54c_badSink(data); } #endif /* OMITBAD */ #ifndef OMITGOOD /* good function declaration */ void CWE90_LDAP_Injection__w32_wchar_t_listen_socket_54c_goodG2BSink(wchar_t * data); /* goodG2B uses the GoodSource with the BadSink */ void CWE90_LDAP_Injection__w32_wchar_t_listen_socket_54b_goodG2BSink(wchar_t * data) { CWE90_LDAP_Injection__w32_wchar_t_listen_socket_54c_goodG2BSink(data); } #endif /* OMITGOOD */