hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 21:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

QL tests for Python queries and libraries.

Browse Source
This commit is contained in:
Mark Shannon
2018-11-19 15:15:54 +00:00
parent 90c75cd362
commit 05b69a1c0f
1140 changed files with 32676 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
python/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected Normal file
View File

@@ -0,0 +1 @@
| ../lib/flask/__init__.py:16:25:16:26 | flask.response.argument | Cross-site scripting vulnerability due to $@. | reflected_xss.py:7:18:7:29 | flask.request.args | user-provided value |

1
python/ql/test/query-tests/Security/CWE-079/ReflectedXss.qlref Normal file
View File

@@ -0,0 +1 @@
Security/CWE-079/ReflectedXss.ql

1
python/ql/test/query-tests/Security/CWE-079/options Normal file
View File

@@ -0,0 +1 @@
semmle-extractor-options: -p ../lib/ --max-import-depth=3

18
python/ql/test/query-tests/Security/CWE-079/reflected_xss.py Normal file
View File

@@ -0,0 +1,18 @@
from flask import Flask, request, make_response, escape
app = Flask(__name__)
@app.route('/unsafe')
def unsafe():
first_name = request.args.get('name', '')
return make_response("Your name is " + first_name)
@app.route('/safe')
def safe():
first_name = request.args.get('name', '')
return make_response("Your name is " + escape(first_name))
urlpatterns = [
url(r'^r1$', response_unsafe, name='response-unsafe'),
url(r'^r2$', response_safe, name='response-safe')
]