It looks like it does not take into account that Filter.toString/encode can actually encode LDAP filter correctly. So if I have a flags something like
Filter filter = blahblah;
ldapTemplate.search("", filter.toString());
it would flag that this code is vulnerable to LDAP injection where it should not.
How do I make findsec-bugs-plugin not to flag this kind of usage as an issue?