SEC017
LDAP injection via concatenation
Object Pascal — Delphi & Free Pascal
Warning
Security
Concatenating user input into LDAP filters enables directory injection attacks
concatenating user input into LDAP filters enables directory injection attacks.
Why this severity
concatenating user input into LDAP filters enables directory injection attacks.
Known false positives
filters built entirely from trusted internal constants.
Remediation example
Filter := Format('(cn=%s)', [LdapEscape(UserName)]);