andrewmusselman opened a new issue, #702:
URL: https://github.com/apache/tooling-trusted-releases/issues/702
**ASVS:** 15.3.1 · Finding 4
**Severity:** HIGH
**CWE:** CWE-200 (Exposure of Sensitive Information)
### Description
LDAP search in `atr/ldap.py` (lines 203–206) fetches `ldap3.ALL_ATTRIBUTES`
by default, and the admin LDAP lookup template in `atr/admin/__init__.py`
(lines 345–381) iterates and displays all returned attributes without filtering:
```python
attributes = email_attributes if params.email_only else ldap3.ALL_ATTRIBUTES
```
```html
{% for key, value in result.items()|sort %}
<tr><td><strong>{{ key }}</strong></td><td>{{ value }}</td></tr>
{% endfor %}
```
This may expose sensitive internal LDAP attributes to admin users.
### Recommendation
1. Make this dev-only
2. Ensure it's conditional in top nav
3. Add comment for LLM (in sub-issue)
From audit:
Replace `ALL_ATTRIBUTES` with an explicit allowlist:
```python
SAFE_USER_ATTRIBUTES = ["uid", "cn", "mail", "asf-altEmail",
"asf-committer-email"]
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
