title: Fortify complaints about LDAP entry poisoning
body: <p>In my project, I am using below code for the authentication using LDAP, In my WeBSecurityContext</p>
  
  <pre><code> authenticationMngrBuilder.ldapAuthentication().userDetailsContextMapper(getLdapUser())
              .contextSource(ldapContext())
              .userSearchFilter("(&amp;(objectClass=user)))");
  </code></pre>
  
  <p>Here "authenticationMngrBuilder"is of type org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder</p>
  
  <p>"LDAP Entry Poisoning
  An application that performs an object-returning LDAP search will allow attackers to control the LDAP response to run arbitrary code on the server."</p>
  
  <p>Fortify scan complaints that this is vulnerable because it returns LDAP response as Java object.</p>
  
  <p>Any other alternative for this?</p>