Skip to content

Commit

Permalink
pattern-source - fix parameter order = Update ldap-injection.yaml (#…
Browse files Browse the repository at this point in the history
…3019)

* Update ldap-injection.yaml - pattern-sources - parameter order

Expanding the detection to support vulnerable parameter at any order.
The previous pattern will only match if the vulnerable parameter is the first parameter in the function declaration.
As the vulnerable parameter can be at any place, I added "..." padding before and after

* Update csharp/dotnet/security/audit/ldap-injection.yaml

---------

Co-authored-by: Kurt Boberg <[email protected]>
Co-authored-by: Claudio <[email protected]>
  • Loading branch information
3 people authored Jan 8, 2025
1 parent 1c92567 commit fc289a2
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion csharp/dotnet/security/audit/ldap-injection.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ rules:
pattern-sources:
- patterns:
- focus-metavariable: $INPUT
- pattern-inside: $T $M($INPUT,...) {...}
- pattern-inside: $T $M(...,$INPUT,...) {...}
pattern-sinks:
- patterns:
- pattern-either:
Expand Down

0 comments on commit fc289a2

Please sign in to comment.