[pitboss] phase 06: Track J.4 + Track L.4 — LDAP_INJECTION corpus + LdapTemplate / python-ldap / php-ldap adapters

src/dynamic/framework/adapters/ldap_php.rs

@@ -0,0 +1,114 @@
+//! PHP [`super::super::FrameworkAdapter`] matching LDAP filter-injection
+//! sink constructions.
+//!
+//! Phase 06 (Track J.4).  Fires when the function body invokes one of
+//! the canonical PHP directory-client entry points (`ldap_search`,
+//! `ldap_list`, `ldap_read`) and the surrounding source mentions the
+//! matching `ldap_*` API surface.
+
+use crate::dynamic::framework::{FrameworkAdapter, FrameworkBinding};
+use crate::evidence::EntryKind;
+use crate::summary::FuncSummary;
+use crate::symbol::Lang;
+
+pub struct LdapPhpAdapter;
+
+const ADAPTER_NAME: &str = "ldap-php";
+
+fn callee_is_ldap_search(name: &str) -> bool {
+    let last = name
+        .rsplit_once("::")
+        .map(|(_, s)| s)
+        .or_else(|| name.rsplit_once('.').map(|(_, s)| s))
+        .or_else(|| name.rsplit_once("->").map(|(_, s)| s))
+        .unwrap_or(name);
+    matches!(last, "ldap_search" | "ldap_list" | "ldap_read")
+}
+
+fn source_imports_ldap(file_bytes: &[u8]) -> bool {
+    const NEEDLES: &[&[u8]] = &[
+        b"ldap_connect",
+        b"ldap_bind",
+        b"ldap_search",
+        b"ldap_list",
+        b"ldap_read",
+        b"ldap_escape",
+    ];
+    NEEDLES
+        .iter()
+        .any(|n| file_bytes.windows(n.len()).any(|w| w == *n))
+}
+
+impl FrameworkAdapter for LdapPhpAdapter {
+    fn name(&self) -> &'static str {
+        ADAPTER_NAME
+    }
+
+    fn lang(&self) -> Lang {
+        Lang::Php
+    }
+
+    fn detect(
+        &self,
+        summary: &FuncSummary,
+        _ast: tree_sitter::Node<'_>,
+        file_bytes: &[u8],
+    ) -> Option<FrameworkBinding> {
+        let matches_call = super::any_callee_matches(summary, callee_is_ldap_search);
+        let matches_source = source_imports_ldap(file_bytes);
+        if matches_call && matches_source {
+            Some(FrameworkBinding {
+                adapter: ADAPTER_NAME.to_owned(),
+                kind: EntryKind::Function,
+                route: None,
+                request_params: Vec::new(),
+                response_writer: None,
+                middleware: Vec::new(),
+            })
+        } else {
+            None
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn parse_php(src: &[u8]) -> tree_sitter::Tree {
+        let mut parser = tree_sitter::Parser::new();
+        let lang = tree_sitter::Language::from(tree_sitter_php::LANGUAGE_PHP);
+        parser.set_language(&lang).unwrap();
+        parser.parse(src, None).unwrap()
+    }
+
+    #[test]
+    fn fires_on_ldap_search() {
+        let src: &[u8] = b"<?php\nfunction run($uid) {\n\
+            $c = ldap_connect('127.0.0.1');\n\
+            return ldap_search($c, 'ou=people', '(uid=' . $uid . ')');\n\
+        }\n";
+        let tree = parse_php(src);
+        let summary = FuncSummary {
+            name: "run".into(),
+            callees: vec![crate::summary::CalleeSite::bare("ldap_search")],
+            ..Default::default()
+        };
+        assert!(LdapPhpAdapter
+            .detect(&summary, tree.root_node(), src)
+            .is_some());
+    }
+
+    #[test]
+    fn skips_plain_function() {
+        let src: &[u8] = b"<?php\nfunction add($a, $b) { return $a + $b; }\n";
+        let tree = parse_php(src);
+        let summary = FuncSummary {
+            name: "add".into(),
+            ..Default::default()
+        };
+        assert!(LdapPhpAdapter
+            .detect(&summary, tree.root_node(), src)
+            .is_none());
+    }
+}

src/dynamic/framework/adapters/ldap_python.rs

@@ -0,0 +1,113 @@
+//! Python [`super::super::FrameworkAdapter`] matching LDAP filter-injection
+//! sink constructions.
+//!
+//! Phase 06 (Track J.4).  Fires when the function body invokes one of
+//! the canonical `python-ldap` / `ldap3` entry points
+//! (`ldap.search_s`, `ldap.search_ext_s`, `ldap.search`,
+//! `Connection.search`) and the surrounding source mentions the
+//! matching client module.
+
+use crate::dynamic::framework::{FrameworkAdapter, FrameworkBinding};
+use crate::evidence::EntryKind;
+use crate::summary::FuncSummary;
+use crate::symbol::Lang;
+
+pub struct LdapPythonAdapter;
+
+const ADAPTER_NAME: &str = "ldap-python";
+
+fn callee_is_ldap_search(name: &str) -> bool {
+    let last = name.rsplit_once('.').map(|(_, s)| s).unwrap_or(name);
+    matches!(
+        last,
+        "search_s" | "search_ext_s" | "search" | "search_st" | "search_subtree_s"
+    )
+}
+
+fn source_imports_ldap(file_bytes: &[u8]) -> bool {
+    const NEEDLES: &[&[u8]] = &[
+        b"import ldap",
+        b"from ldap",
+        b"ldap3",
+        b"python-ldap",
+        b"ldap.initialize",
+        b"ldap.SCOPE",
+    ];
+    NEEDLES
+        .iter()
+        .any(|n| file_bytes.windows(n.len()).any(|w| w == *n))
+}
+
+impl FrameworkAdapter for LdapPythonAdapter {
+    fn name(&self) -> &'static str {
+        ADAPTER_NAME
+    }
+
+    fn lang(&self) -> Lang {
+        Lang::Python
+    }
+
+    fn detect(
+        &self,
+        summary: &FuncSummary,
+        _ast: tree_sitter::Node<'_>,
+        file_bytes: &[u8],
+    ) -> Option<FrameworkBinding> {
+        let matches_call = super::any_callee_matches(summary, callee_is_ldap_search);
+        let matches_source = source_imports_ldap(file_bytes);
+        if matches_call && matches_source {
+            Some(FrameworkBinding {
+                adapter: ADAPTER_NAME.to_owned(),
+                kind: EntryKind::Function,
+                route: None,
+                request_params: Vec::new(),
+                response_writer: None,
+                middleware: Vec::new(),
+            })
+        } else {
+            None
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn parse_python(src: &[u8]) -> tree_sitter::Tree {
+        let mut parser = tree_sitter::Parser::new();
+        let lang = tree_sitter::Language::from(tree_sitter_python::LANGUAGE);
+        parser.set_language(&lang).unwrap();
+        parser.parse(src, None).unwrap()
+    }
+
+    #[test]
+    fn fires_on_ldap_search_s() {
+        let src: &[u8] = b"import ldap\n\
+            def run(uid):\n\
+                con = ldap.initialize('ldap://127.0.0.1')\n\
+                return con.search_s('ou=people', ldap.SCOPE_SUBTREE, '(uid=' + uid + ')')\n";
+        let tree = parse_python(src);
+        let summary = FuncSummary {
+            name: "run".into(),
+            callees: vec![crate::summary::CalleeSite::bare("search_s")],
+            ..Default::default()
+        };
+        assert!(LdapPythonAdapter
+            .detect(&summary, tree.root_node(), src)
+            .is_some());
+    }
+
+    #[test]
+    fn skips_plain_function() {
+        let src: &[u8] = b"def add(a, b):\n    return a + b\n";
+        let tree = parse_python(src);
+        let summary = FuncSummary {
+            name: "add".into(),
+            ..Default::default()
+        };
+        assert!(LdapPythonAdapter
+            .detect(&summary, tree.root_node(), src)
+            .is_none());
+    }
+}

src/dynamic/framework/adapters/ldap_spring.rs

@@ -0,0 +1,133 @@
+//! Java [`super::super::FrameworkAdapter`] matching LDAP filter-injection
+//! sink constructions.
+//!
+//! Phase 06 (Track J.4).  Fires when the function body invokes one of
+//! the canonical Java directory-client entry points
+//! (`LdapTemplate.search`, `LdapTemplate.find`, `DirContext.search`,
+//! `InitialDirContext.search`, `LdapContext.search`) and the
+//! surrounding source pulls in one of the matching package symbols —
+//! `org.springframework.ldap.*`, `javax.naming.directory.*`,
+//! `com.unboundid.ldap.*`.
+
+use crate::dynamic::framework::{FrameworkAdapter, FrameworkBinding};
+use crate::evidence::EntryKind;
+use crate::summary::FuncSummary;
+use crate::symbol::Lang;
+
+pub struct LdapSpringAdapter;
+
+const ADAPTER_NAME: &str = "ldap-spring";
+
+fn callee_is_ldap_search(name: &str) -> bool {
+    let last = name.rsplit_once('.').map(|(_, s)| s).unwrap_or(name);
+    matches!(
+        last,
+        "search" | "find" | "findAll" | "findOne" | "lookup" | "searchAll"
+    )
+}
+
+fn source_imports_ldap(file_bytes: &[u8]) -> bool {
+    const NEEDLES: &[&[u8]] = &[
+        b"org.springframework.ldap",
+        b"LdapTemplate",
+        b"javax.naming.directory",
+        b"InitialDirContext",
+        b"DirContext",
+        b"LdapContext",
+        b"com.unboundid.ldap",
+        b"SearchControls",
+    ];
+    NEEDLES
+        .iter()
+        .any(|n| file_bytes.windows(n.len()).any(|w| w == *n))
+}
+
+impl FrameworkAdapter for LdapSpringAdapter {
+    fn name(&self) -> &'static str {
+        ADAPTER_NAME
+    }
+
+    fn lang(&self) -> Lang {
+        Lang::Java
+    }
+
+    fn detect(
+        &self,
+        summary: &FuncSummary,
+        _ast: tree_sitter::Node<'_>,
+        file_bytes: &[u8],
+    ) -> Option<FrameworkBinding> {
+        let matches_call = super::any_callee_matches(summary, callee_is_ldap_search);
+        let matches_source = source_imports_ldap(file_bytes);
+        if matches_call && matches_source {
+            return Some(FrameworkBinding {
+                adapter: ADAPTER_NAME.to_owned(),
+                kind: EntryKind::Function,
+                route: None,
+                request_params: Vec::new(),
+                response_writer: None,
+                middleware: Vec::new(),
+            });
+        }
+        if matches_source
+            && file_bytes
+                .windows(b".search(".len())
+                .any(|w| w == b".search(")
+        {
+            return Some(FrameworkBinding {
+                adapter: ADAPTER_NAME.to_owned(),
+                kind: EntryKind::Function,
+                route: None,
+                request_params: Vec::new(),
+                response_writer: None,
+                middleware: Vec::new(),
+            });
+        }
+        None
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn parse_java(src: &[u8]) -> tree_sitter::Tree {
+        let mut parser = tree_sitter::Parser::new();
+        let lang = tree_sitter::Language::from(tree_sitter_java::LANGUAGE);
+        parser.set_language(&lang).unwrap();
+        parser.parse(src, None).unwrap()
+    }
+
+    #[test]
+    fn fires_on_ldap_template_search() {
+        let src: &[u8] = b"import org.springframework.ldap.core.LdapTemplate;\n\
+            public class V {\n  public Object run(String uid, LdapTemplate t) {\n\
+                return t.search(\"ou=people\", \"(uid=\" + uid + \")\", null);\n\
+            }\n}\n";
+        let tree = parse_java(src);
+        let summary = FuncSummary {
+            name: "run".into(),
+            callees: vec![crate::summary::CalleeSite::bare("search")],
+            ..Default::default()
+        };
+        let binding = LdapSpringAdapter
+            .detect(&summary, tree.root_node(), src)
+            .expect("must fire on LdapTemplate.search");
+        assert_eq!(binding.adapter, ADAPTER_NAME);
+        assert_eq!(binding.kind, EntryKind::Function);
+    }
+
+    #[test]
+    fn skips_plain_function() {
+        let src: &[u8] =
+            b"public class V { public static int add(int a, int b) { return a + b; } }\n";
+        let tree = parse_java(src);
+        let summary = FuncSummary {
+            name: "add".into(),
+            ..Default::default()
+        };
+        assert!(LdapSpringAdapter
+            .detect(&summary, tree.root_node(), src)
+            .is_none());
+    }
+}

src/dynamic/framework/adapters/mod.rs

@@ -14,6 +14,9 @@
 pub mod java_deserialize;
 pub mod java_thymeleaf;
 pub mod js_handlebars;
+pub mod ldap_php;
+pub mod ldap_python;
+pub mod ldap_spring;
 pub mod php_twig;
 pub mod php_unserialize;
 pub mod python_jinja2;
@@ -29,6 +32,9 @@ pub mod xxe_ruby;
 pub use java_deserialize::JavaDeserializeAdapter;
 pub use java_thymeleaf::JavaThymeleafAdapter;
 pub use js_handlebars::JsHandlebarsAdapter;
+pub use ldap_php::LdapPhpAdapter;
+pub use ldap_python::LdapPythonAdapter;
+pub use ldap_spring::LdapSpringAdapter;
 pub use php_twig::PhpTwigAdapter;
 pub use php_unserialize::PhpUnserializeAdapter;
 pub use python_jinja2::PythonJinja2Adapter;

src/dynamic/framework/mod.rs

@@ -214,25 +214,35 @@ mod tests {
     }
 
     #[test]
-    fn registry_baseline_after_phase_05() {
-        // Phase 05 (Track J.3) adds the XXE-sink adapter alongside the
-        // Phase-03 deserialize + Phase-04 SSTI adapters for Java /
-        // Python / PHP / Ruby, and introduces the first Go adapter
-        // (xxe-go).  JavaScript still has only the Handlebars adapter;
-        // Rust / C / Cpp / TypeScript still carry the Phase-01 empty
-        // baseline.
-        for lang in [Lang::Java, Lang::Python, Lang::Php, Lang::Ruby] {
+    fn registry_baseline_after_phase_06() {
+        // Phase 06 (Track J.4) adds the LDAP-sink adapter for Java /
+        // Python / PHP, layered on top of the Phase 03 deserialize +
+        // Phase 04 SSTI + Phase 05 XXE adapters.  Ruby still carries
+        // exactly the 03+04+05 trio (no Ruby LDAP adapter this
+        // phase); Go still has only the XXE adapter; JavaScript still
+        // has only the Handlebars adapter; Rust / C / Cpp /
+        // TypeScript still carry the Phase-01 empty baseline.
+        for lang in [Lang::Java, Lang::Python, Lang::Php] {
             let registered = registry::adapters_for(lang);
             assert_eq!(
                 registered.len(),
-                3,
-                "{:?} must have the J.1 deserialize + J.2 ssti + J.3 xxe adapters",
+                4,
+                "{:?} must have the J.1 deserialize + J.2 ssti + J.3 xxe + J.4 ldap adapters",
                 lang,
             );
             for adapter in registered {
                 assert_eq!(adapter.lang(), lang);
             }
         }
+        let ruby_registered = registry::adapters_for(Lang::Ruby);
+        assert_eq!(
+            ruby_registered.len(),
+            3,
+            "Ruby must still carry the J.1 deserialize + J.2 ssti + J.3 xxe adapters",
+        );
+        for adapter in ruby_registered {
+            assert_eq!(adapter.lang(), Lang::Ruby);
+        }
         let js_registered = registry::adapters_for(Lang::JavaScript);
         assert_eq!(
             js_registered.len(),

src/dynamic/framework/registry.rs

@@ -50,15 +50,18 @@ static CPP: &[&dyn FrameworkAdapter] = &[];
 static JAVA: &[&dyn FrameworkAdapter] = &[
     &super::adapters::JavaDeserializeAdapter,
     &super::adapters::JavaThymeleafAdapter,
+    &super::adapters::LdapSpringAdapter,
     &super::adapters::XxeJavaAdapter,
 ];
 static GO: &[&dyn FrameworkAdapter] = &[&super::adapters::XxeGoAdapter];
 static PHP: &[&dyn FrameworkAdapter] = &[
+    &super::adapters::LdapPhpAdapter,
     &super::adapters::PhpTwigAdapter,
     &super::adapters::PhpUnserializeAdapter,
     &super::adapters::XxePhpAdapter,
 ];
 static PYTHON: &[&dyn FrameworkAdapter] = &[
+    &super::adapters::LdapPythonAdapter,
     &super::adapters::PythonJinja2Adapter,
     &super::adapters::PythonPickleAdapter,
     &super::adapters::XxePythonAdapter,