Add additional Ratpack test and improve Promise based dataflow tracking

This commit is contained in:
Jonathan Leitschuh
2021-04-30 14:58:37 -04:00
parent dabf00e8b4
commit 170657b9a4
5 changed files with 119 additions and 9 deletions

View File

@@ -1,5 +1,7 @@
import ratpack.core.handling.Context;
import ratpack.core.http.TypedData;
import ratpack.core.form.UploadedFile;
import java.io.OutputStream;
class Resource {
@@ -10,18 +12,45 @@ class Resource {
sink(ctx.getRequest().getCookies()); //$hasTaintFlow
sink(ctx.getRequest().oneCookie("Magic-Cookie")); //$hasTaintFlow
sink(ctx.getRequest().getHeaders()); //$hasTaintFlow
sink(ctx.getRequest().getHeaders().get("questionable_header")); //$hasTaintFlow
sink(ctx.getRequest().getHeaders().getAll("questionable_header")); //$hasTaintFlow
sink(ctx.getRequest().getHeaders().getNames()); //$hasTaintFlow
sink(ctx.getRequest().getHeaders().asMultiValueMap()); //$hasTaintFlow
sink(ctx.getRequest().getHeaders().asMultiValueMap().get("questionable_header")); //$hasTaintFlow
sink(ctx.getRequest().getPath()); //$hasTaintFlow
sink(ctx.getRequest().getQuery()); //$hasTaintFlow
sink(ctx.getRequest().getQueryParams()); //$hasTaintFlow
sink(ctx.getRequest().getQueryParams().get("questionable_parameter")); //$hasTaintFlow
sink(ctx.getRequest().getRawUri()); //$hasTaintFlow
sink(ctx.getRequest().getUri()); //$hasTaintFlow
}
void test2(TypedData td) {
sink(td.getText()); //$hasTaintFlow
sink(td.getBuffer()); //$hasTaintFlow
sink(td.getBytes()); //$hasTaintFlow
sink(td.getContentType()); //$hasTaintFlow
sink(td.getInputStream()); //$hasTaintFlow
}
void test2(Context ctx) {
void test3(TypedData td, OutputStream os) throws java.io.IOException {
sink(os);
td.writeTo(os);
sink(os); //$hasTaintFlow
}
void test4(UploadedFile uf) {
sink(uf.getFileName()); //$hasTaintFlow
}
void test5(Context ctx) {
sink(ctx.getRequest().getBody().map(TypedData::getText)); //$hasTaintFlow
ctx.getRequest().getBody().map(TypedData::getText).then(this::sink); //$hasTaintFlow
ctx
.getRequest()
.getBody()
.map(TypedData::getText)
.next(this::sink) //$hasTaintFlow
.then(this::sink); //$hasTaintFlow
}
}

View File

@@ -0,0 +1,37 @@
/*
* Copyright 2013 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package ratpack.core.form;
import ratpack.core.http.TypedData;
import ratpack.func.Nullable;
/**
* A file that was uploaded via a form.
*
* @see Form
*/
public interface UploadedFile extends TypedData {
/**
* The name given for the file.
*
* @return The name given for the file, or {@code null} if no name was provided.
*/
@Nullable
String getFileName();
}

View File

@@ -46,4 +46,6 @@ public interface Promise<T> {
<O> Promise<O> map(Function<? super T, ? extends O> transformer);
void then(Action<? super T> then);
Promise<T> next(Action<? super T> action);
}