You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 21:42:06 UTC
[I] Implement LDAP attribute allowlist instead of `ALL_ATTRIBUTES` (tooling-trusted-releases)
andrewmusselman opened a new issue, #702:
URL: https://github.com/apache/tooling-trusted-releases/issues/702
**ASVS:** 15.3.1 · Finding 4
**Severity:** HIGH
**CWE:** CWE-200 (Exposure of Sensitive Information)
### Description
LDAP search in `atr/ldap.py` (lines 203–206) fetches `ldap3.ALL_ATTRIBUTES` by default, and the admin LDAP lookup template in `atr/admin/__init__.py` (lines 345–381) iterates and displays all returned attributes without filtering:
```python
attributes = email_attributes if params.email_only else ldap3.ALL_ATTRIBUTES
```
```html
{% for key, value in result.items()|sort %}
<tr><td><strong>{{ key }}</strong></td><td>{{ value }}</td></tr>
{% endfor %}
```
This may expose sensitive internal LDAP attributes to admin users.
### Recommendation
1. Make this dev-only
2. Ensure it's conditional in top nav
3. Add comment for LLM (in sub-issue)
From audit:
Replace `ALL_ATTRIBUTES` with an explicit allowlist:
```python
SAFE_USER_ATTRIBUTES = ["uid", "cn", "mail", "asf-altEmail", "asf-committer-email"]
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Implement LDAP attribute allowlist instead of `ALL_ATTRIBUTES` (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #702:
URL: https://github.com/apache/tooling-trusted-releases/issues/702#issuecomment-4005418370
I suppose this could be made a development environment only route.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Implement LDAP attribute allowlist instead of `ALL_ATTRIBUTES` (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #702:
URL: https://github.com/apache/tooling-trusted-releases/issues/702#issuecomment-4005757745
Resolved by 192c98816afb8f0610b96e9e8f078af9c64b232f which uses a subset and structured type safe LDAP responses.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Implement LDAP attribute allowlist instead of `ALL_ATTRIBUTES` (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp closed issue #702: Implement LDAP attribute allowlist instead of `ALL_ATTRIBUTES`
URL: https://github.com/apache/tooling-trusted-releases/issues/702
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Implement LDAP attribute allowlist instead of `ALL_ATTRIBUTES` (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #702:
URL: https://github.com/apache/tooling-trusted-releases/issues/702#issuecomment-4005430834
Another potential alternative is to develop a separate microapp for LDAP queries.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Implement LDAP attribute allowlist instead of `ALL_ATTRIBUTES` (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #702:
URL: https://github.com/apache/tooling-trusted-releases/issues/702#issuecomment-4005411003
Admin users already have full access to all of LDAP. Closing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org