[dwisiswant0]

Proposed changes

LDAP was the only JS protocol client that reached
the dialer without an IsHostAllowed check.
Validate ldap, ldaps, and cldap hosts before
connecting, and treat ldapi as loopback so
restricted local network access rejects Unix
socket LDAP before the socket path is opened.

Proof

Checklist

• Pull request is created against the dev branch
• All checks passed (lint, unit/integration/regression tests etc.) with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Summary by CodeRabbit

• Bug Fixes

  • Enhanced network policy enforcement for LDAP connections, ensuring restricted local network access is properly validated before connection attempts are made.

• Tests

  • Added comprehensive test coverage for network policy validation in LDAP connection scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 31e12eaf-b484-48fc-b266-5c623f88d3c5

📥 Commits

Reviewing files that changed from the base of the PR and between 323df47 and 0a2ed8f.

📒 Files selected for processing (2)

• pkg/js/libs/ldap/ldap.go
• pkg/js/libs/ldap/ldap_test.go

---

Walkthrough

NewClient in the LDAP library is refactored to enforce protocolstate.IsHostAllowed allowlist checks before dialing for all schemes: ldapi checks against a fixed 127.0.0.1 policy host, while ldap/cldap/ldaps derive and validate the host first. Scheme defaulting is moved earlier. Three new tests verify denial and allowance behavior.

Changes

LDAP Client Network Policy Enforcement

Layer / File(s)	Summary
NewClient scheme defaulting and allowlist enforcement pkg/js/libs/ldap/ldap.go	Imports reordered; u.Scheme now defaults to "ldap" immediately after url.Parse; dialing branch refactored so ldapi checks protocolstate.IsHostAllowed against 127.0.0.1 and ldap/cldap/ldaps extract host via u.Hostname(), validate non-empty, then check IsHostAllowed before dialing.
Network policy tests and helpers pkg/js/libs/ldap/ldap_test.go	Adds TestNewClientDeniesRestrictedLocalTCPBeforeDial and TestNewClientDeniesLDAPIAsLocalNetworkAccess asserting errors contain "network policy" before any dial; TestNewClientAllowsTCPWhenNetworkPolicyAllows verifies a local listener receives a connection; helper functions manage protocolstate lifecycle and centralize policy-denial assertions.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐇 A bunny guards the LDAP gate,
No sneaky socket slips through late!
IsHostAllowed checks the list,
ldapi and ldap — none are missed.
The tests confirm: deny before dial,
Secure connections, hop-by-hop style! 🔒

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: implementing network policy validation before LDAP connections are established.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dwisiswant0/fix/js/respect-network-policy-before-dialing-ldap

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[dwisiswant0]

@coderabbitai create an issue for this.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

gh issue create \
  --repo "projectdiscovery/nuclei" \
  --title "LDAP JS client missing IsHostAllowed check — network policy bypass" \
  --assignee "dwisiswant0" \
  --body "## Summary

The LDAP JavaScript protocol client in \`pkg/js/libs/ldap/ldap.go\` was the only JS protocol client that could reach the dialer without an \`IsHostAllowed\` check. This meant network access restrictions (\`RestrictLocalNetworkAccess\` and similar policies) could be bypassed when a template used the LDAP client.

## Details

- **Affected schemes:** \`ldap://\`, \`ldaps://\` (LDAP over TLS), \`cldap://\` (connectionless LDAP), \`ldapi://\` (LDAP over Unix sockets)
- **Root cause:** \`NewClient\` in \`pkg/js/libs/ldap/ldap.go\` did not call \`protocolstate.IsHostAllowed\` before dialing, unlike all other JS protocol clients.
- **Impact:** A nuclei template using the LDAP client could establish connections to hosts that should be blocked by the configured network policy.

## Expected behaviour

Connections to restricted hosts/networks via the LDAP client should be denied with a network-policy error before any dialing attempt, consistent with other protocol clients.

## Fix (implemented in `#7494`)

- For \`ldap\`, \`ldaps\`, and \`cldap\`: derive the target host and call \`protocolstate.IsHostAllowed\` before dialing.
- For \`ldapi\` (Unix sockets): treat the connection as loopback (\`127.0.0.1\`) so that \`RestrictLocalNetworkAccess\` policies correctly reject it before the socket path is opened.

## References

- PR: https://github.com/projectdiscovery/nuclei/pull/7494
- Reported by: `@dwisiswant0`"

Length of output: 1828

---

---

@dwisiswant0, the issue has been created and assigned to you: #7496 🐇