new capacity bits (#67)

tests/fixtures/ldap_injection/cpp/baseline_constant_ldap.cpp

@@ -0,0 +1,12 @@
+// Baseline: literal filter, no taint reaches the sink.
+#include <ldap.h>
+
+int do_lookup(LDAP* ld) {
+    LDAPMessage* res = nullptr;
+    return ldap_search_ext_s(
+        ld,
+        "ou=people,dc=example,dc=com",
+        LDAP_SCOPE_SUBTREE,
+        "(objectClass=person)",
+        nullptr, 0, nullptr, nullptr, nullptr, 0, &res);
+}

tests/fixtures/ldap_injection/cpp/safe_ldap_search.cpp

@@ -0,0 +1,18 @@
+// Safe: developer-named sanitize_* helper clears caps on the user value
+// before it reaches ldap_search_ext_s.
+#include <cstdlib>
+#include <ldap.h>
+
+extern const char* sanitize_ldap_filter(const char* raw);
+
+int do_lookup(LDAP* ld) {
+    const char* user_filter = std::getenv("USER_FILTER");
+    const char* safe = sanitize_ldap_filter(user_filter);
+    LDAPMessage* res = nullptr;
+    return ldap_search_ext_s(
+        ld,
+        "ou=people,dc=example,dc=com",
+        LDAP_SCOPE_SUBTREE,
+        safe,
+        nullptr, 0, nullptr, nullptr, nullptr, 0, &res);
+}

tests/fixtures/ldap_injection/cpp/unsafe_ldap_search.cpp

@@ -0,0 +1,15 @@
+// Unsafe: tainted env value passed straight as the LDAP filter argument to
+// ldap_search_ext_s.  LDAP_INJECTION fires on the filter argument (position 3).
+#include <cstdlib>
+#include <ldap.h>
+
+int do_lookup(LDAP* ld) {
+    const char* user_filter = std::getenv("USER_FILTER");
+    LDAPMessage* res = nullptr;
+    return ldap_search_ext_s(
+        ld,
+        "ou=people,dc=example,dc=com",
+        LDAP_SCOPE_SUBTREE,
+        user_filter,
+        nullptr, 0, nullptr, nullptr, nullptr, 0, &res);
+}