JNDI supports the deserialization of objects from LDAP directories, which can lead to remote code execution.
This rule raises an issue when an LDAP search query is executed with SearchControls configured to allow deserialization.
Ask Yourself Whether
- The application connects to an untrusted LDAP directory.
- User-controlled objects can be stored in the LDAP directory.
There is a risk if you answered yes to any of those questions.
Recommended Secure Coding Practices
It is recommended to disable deserialization of LDAP objects.
Sensitive Code Example
DirContext ctx = new InitialDirContext();
// ...
ctx.search(query, filter,
new SearchControls(scope, countLimit, timeLimit, attributes,
true, // Noncompliant; allows deserialization
deref));
Compliant Solution
DirContext ctx = new InitialDirContext();
// ...
ctx.search(query, filter,
new SearchControls(scope, countLimit, timeLimit, attributes,
false, // Compliant
deref));
See
