Python: Model ldap3 paged searches

Author: theinfosecguy

python/ql/lib/change-notes/2026-08-07-ldap3-paged-search.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `py/ldap-injection` query now detects user-controlled search bases and filters passed to `ldap3.Connection.extend.standard.paged_search`.

python/ql/lib/semmle/python/frameworks/Ldap3.qll

@@ -23,6 +23,15 @@ private module Ldap3 {
             .getReturn()
             .getMember("search")
             .getACall()
+      or
+      this =
+        API::moduleImport("ldap3")
+            .getMember("Connection")
+            .getReturn()
+            .getMember("extend")
+            .getMember("standard")
+            .getMember("paged_search")
+            .getACall()
     }
 
     override DataFlow::Node getFilter() {