UniqAI/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui synced 2024-11-16 21:42:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix code scanning alert no. 129: LDAP query built from user-controlled sources

Browse Source 
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This commit is contained in:
Timothy Jaeryang Baek 2024-11-05 18:10:16 -05:00 committed by GitHub
parent fe68a0776c
commit 1f36cad9ef
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
backend/open_webui/apps/webui/routers/auths.py
View File

@ -44,6 +44,7 @@ from typing import Optional, List
from ldap3 import Server, Connection, ALL, Tls from ldap3 import Server, Connection, ALL, Tls
from ssl import CERT_REQUIRED, PROTOCOL_TLS from ssl import CERT_REQUIRED, PROTOCOL_TLS
from ldap3.utils.conv import escape_filter_chars
router = APIRouter() router = APIRouter()
@ -181,7 +182,7 @@ async def ldap_auth(request: Request, response: Response, form_data: LdapForm):
search_success = connection_app.search( search_success = connection_app.search(
search_base=LDAP_SEARCH_BASE, search_base=LDAP_SEARCH_BASE,
search_filter=f'(&({LDAP_ATTRIBUTE_FOR_USERNAME}={form_data.user.lower()}){LDAP_SEARCH_FILTERS})', search_filter=f'(&({LDAP_ATTRIBUTE_FOR_USERNAME}={escape_filter_chars(form_data.user.lower())}){LDAP_SEARCH_FILTERS})',
attributes=[f'{LDAP_ATTRIBUTE_FOR_USERNAME}', 'mail', 'cn'] attributes=[f'{LDAP_ATTRIBUTE_FOR_USERNAME}', 'mail', 'cn']
) )