JNDI supports the deserialization of objects from LDAP directories, which can lead to remote code execution.
This rule raises an issue when an LDAP search query is executed with SearchControls
configured to allow deserialization.
There is a risk if you answered yes to any of those questions.
It is recommended to disable deserialization of LDAP objects.
DirContext ctx = new InitialDirContext(); // ... ctx.search(query, filter, new SearchControls(scope, countLimit, timeLimit, attributes, true, // Noncompliant; allows deserialization deref));
DirContext ctx = new InitialDirContext(); // ... ctx.search(query, filter, new SearchControls(scope, countLimit, timeLimit, attributes, false, // Compliant deref));