hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix xml_sax_parser.py good/bad naming

Browse Source
This commit is contained in:
jorgectf
2021-10-16 09:50:58 +02:00
parent 8df3dab121
commit 15dfc6d1da
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
python/ql/test/experimental/query-tests/Security/CWE-611/xml_sax_make_parser.py
View File

@@ -32,24 +32,24 @@ def mainHandler():
def xml_makeparser_MainHandler():
xml_content = request.args['xml_content']
BadHandler = MainHandler()
GoodHandler = MainHandler()
parser = xml.sax.make_parser()
parser.setContentHandler(BadHandler)
parser.setContentHandler(GoodHandler)
parser.parse(StringIO(xml_content))
return BadHandler._result
return GoodHandler._result
@app.route("/xml.sax.make_parser()+MainHandler-xml.sax.handler.feature_external_ges_False")
def xml_makeparser_MainHandler_entitiesFalse():
xml_content = request.args['xml_content']
BadHandler = MainHandler()
GoodHandler = MainHandler()
parser = xml.sax.make_parser()
parser.setContentHandler(BadHandler)
parser.setContentHandler(GoodHandler)
# https://docs.python.org/3/library/xml.sax.handler.html#xml.sax.handler.feature_external_ges
parser.setFeature(xml.sax.handler.feature_external_ges, False)
parser.parse(StringIO(xml_content))
return BadHandler._result
return GoodHandler._result
# BAD
@@ -58,12 +58,12 @@ def xml_makeparser_MainHandler_entitiesFalse():
def xml_makeparser_MainHandler_entitiesTrue():
xml_content = request.args['xml_content']
GoodHandler = MainHandler()
BadHandler = MainHandler()
parser = xml.sax.make_parser()
parser.setContentHandler(GoodHandler)
parser.setContentHandler(BadHandler)
parser.setFeature(xml.sax.handler.feature_external_ges, True)
parser.parse(StringIO(xml_content))
return GoodHandler._result
return BadHandler._result
@app.route("/xml.sax.make_parser()+xml.dom.minidom.parse-xml.sax.handler.feature_external_ges_True")