    public <T> List<T> search(final String filter, final Object[] filterArgs, final Mapper<T> mapper, final int maxResultCount) {
        final List<T> searchResults = new ArrayList<>();
        for (String searchBase : ldapConfiguration.getSearchBases()) {
            int resultsToFetch = resultsToFetch(maxResultCount, searchResults.size());

            if (resultsToFetch == -1) {
                break;
            }

            try {
                final SearchRequest searchRequest = new SearchRequestImpl()
                        .setScope(SearchScope.SUBTREE)
                        .addAttributes("*")
                        .setSizeLimit(resultsToFetch)
                        .setFilter(format(filter, filterArgs))
                        .setTimeLimit(ldapConfiguration.getSearchTimeout())
                        .setBase(new Dn(searchBase));

                searchResults.addAll(ldapConnectionTemplate.search(searchRequest, mapper));
            } catch (LdapException e) {
                LOG.error(e.getMessage(), e);
            }
        }

        return searchResults;
    }
The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.