LDAP Injection attack safety

[bhavberi]

We should not pass the user input directly to LDAP, but rather use https://www.python-ldap.org/en/latest/reference/ldap-filter.html#ldap.filter.escape_filter_chars to prevent any unwanted attack.

Example of how it should be done:

import ldap
from ldap.filter import escape_filter_chars

search_filter = f"(mail={escape_filter_chars(email)})"
results = conn.search_s(BASE_DN, ldap.SCOPE_SUBTREE, search_filter)

Please read more about it and try to fix it.