Zennoxa Shield
Rules / Java
SHIELD-JAVA-013

LDAP Injection via Concatenated Filter

highJavaCWE-90CVSS 7.3

What it detects

An LDAP search filter built with string concatenation permits LDAP injection.

How to fix

Escape LDAP special characters or use parameterized search with encoded filter values.

Vulnerable — Shield flags thisUserDirectory.java
import javax.naming.directory.DirContext;
import javax.naming.directory.SearchControls;

public class UserDirectory {
    public boolean userExists(DirContext ctx, String username) throws Exception {
        SearchControls controls = new SearchControls();
        return ctx.search("ou=people,dc=example,dc=com", "(uid=" + username + ")", controls).hasMore();
    }
}
Fixed — scans cleanUserDirectory.java
import javax.naming.directory.DirContext;
import javax.naming.directory.SearchControls;

public class UserDirectory {
    public boolean userExists(DirContext ctx, String username) throws Exception {
        SearchControls controls = new SearchControls();
        // {0} is bound by the LDAP provider, which encodes special characters.
        return ctx.search("ou=people,dc=example,dc=com", "(uid={0})", new Object[]{username}, controls).hasMore();
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JAVA-013, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JAVA-013: LDAP Injection via Concatenated Filter — Zennoxa Shield