hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 21:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Model werkzeug Headers

Browse Source 
Also removed a misleading comment link to method on wrong class :D
This commit is contained in:
Rasmus Wriedt Larsen
2021-07-20 17:35:28 +02:00
parent 4d9c86a252
commit 133632119d
3 changed files with 62 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
python/ql/test/library-tests/frameworks/flask/taint_test.py
View File

@@ -96,11 +96,15 @@ def test_taint(name = "World!", number="0", foo="foo"): # $requestHandler route
request.headers, # $ tainted
request.headers['key'], # $ tainted
request.headers.get('key'), # $ tainted
request.headers.get_all('key'), # $ MISSING: tainted
request.headers.getlist('key'), # $ MISSING: tainted
request.headers.get_all('key'), # $ tainted
request.headers.getlist('key'), # $ tainted
# popitem returns `(key, value)`
request.headers.popitem(), # $ tainted
request.headers.popitem()[0], # $ tainted
request.headers.popitem()[1], # $ tainted
# two ways to get (k, v) lists
list(request.headers), # $ tainted
request.headers.to_wsgi_list(), # $ MISSING: tainted
request.headers.to_wsgi_list(), # $ tainted
request.json, # $ tainted
request.json['foo'], # $ tainted