request #24149: Indirect LDAP injection via the ldap_id attribute of a user

LeSuisse · LeSuisse · commit bd47f29847fc · 2021-11-17T16:46:33.000+01:00
A taint annotation has been added to hightlight the issue. A more global
work on this topic will be done in independant contributions.

Change-Id: I969d0ba6d2ff85b418bcaf728f49afc78dd49571
diff --git a/plugins/ldap/include/LDAP_DirectorySynchronization.class.php b/plugins/ldap/include/LDAP_DirectorySynchronization.class.php
@@ -76,7 +76,7 @@ public function syncAll()
 
     public function ldapSync($row, $users_are_suspendable = true)
     {
-        $ldap_query = $this->ldap->getLDAPParam('eduid') . '=' . $row['ldap_id'];
+        $ldap_query = $this->ldap->getLDAPParam('eduid') . '=' . ldap_escape($row['ldap_id'], '', LDAP_ESCAPE_FILTER);
         $userSync   = $this->getLdapUserSync();
         $attributes = $userSync->getSyncAttributes($this->ldap);
 
diff --git a/src/common/DB/Compat/Legacy2018/LegacyDataAccessInterface.php b/src/common/DB/Compat/Legacy2018/LegacyDataAccessInterface.php
@@ -177,6 +177,7 @@ public function fetch($result);
      * @param type $result
      *
      * @return type
+     * @psalm-taint-source ldap
      */
     public function fetchArray($result);
 

Original file line number	Diff line number	Diff line change
`@@ -76,7 +76,7 @@ public function syncAll()`
`76`	`76`
`77`	`77`	`public function ldapSync($row, $users_are_suspendable = true)`
`78`	`78`	`{`
`79`		`- $ldap_query = $this->ldap->getLDAPParam('eduid') . '=' . $row['ldap_id'];`
	`79`	`+ $ldap_query = $this->ldap->getLDAPParam('eduid') . '=' . ldap_escape($row['ldap_id'], '', LDAP_ESCAPE_FILTER);`
`80`	`80`	`$userSync = $this->getLdapUserSync();`
`81`	`81`	`$attributes = $userSync->getSyncAttributes($this->ldap);`
`82`	`82`
Original file line number	Diff line number	Diff line change
`@@ -177,6 +177,7 @@ public function fetch($result);`
`177`	`177`	`* @param type $result`
`178`	`178`	`*`
`179`	`179`	`* @return type`
	`180`	`+ * @psalm-taint-source ldap`
`180`	`181`	`*/`
`181`	`182`	`public function fetchArray($result);`
`182`	`183`