Vulnerable code sample

import ldap

def get_user_roles(connection, username):
    """
    Finds all the groups a user is a member of to determine roles.
    This function contains a vulnerability.
    """
    # Assume 'LDAP_SEARCH_BASE' and 'LDAP_ADMIN_GROUP' are fetched from config
    LDAP_SEARCH_BASE = "ou=users,dc=example,dc=com"
    LDAP_ADMIN_GROUP = "cn=lemur-admins,ou=groups,dc=example,dc=com"

    # VULNERABLE: The username from the login form is used directly in the LDAP
    # filter via string formatting. An attacker can inject valid LDAP filter
    # syntax (e.g., '*)' or 'admin)(|(uid=*))') to manipulate the query's
    # logic and escalate privileges.
    search_filter = "(&(uid=%s)(memberOf=%s))" % (username, LDAP_ADMIN_GROUP)

    try:
        # The application executes the search. If the manipulated query returns any
        # result, the user is incorrectly granted admin privileges.
        results = connection.search_s(
            LDAP_SEARCH_BASE,
            ldap.SCOPE_SUBTREE,
            search_filter,
            ['cn']  # Attributes to return
        )
        if results:
            # If the search returns a result, the user is in the admin group.
            return ['admin']
        else:
            return ['user']
    except ldap.LDAPError:
        # In case of an error or no user found
        return []