hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 08:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Add test highlighting missing routed parameter flow to **kwargs parameter of request handler function

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2023-10-23 16:49:20 +02:00
parent 8b23140a08
commit 24687b4156
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
python/ql/test/library-tests/frameworks/django-v2-v3/taint_test.py
View File

@@ -174,8 +174,20 @@ class ClassView(View):
)
def kwargs_param(request, **kwargs): # $ requestHandler
ensure_tainted(
kwargs, # $ MISSING: tainted
kwargs["foo"], # $ MISSING: tainted
kwargs["bar"] # $ MISSING: tainted
)
ensure_tainted(request) # $ tainted
# fake setup, you can't actually run this
urlpatterns = [
path("test-taint/<foo>/<bar>", test_taint), # $ routeSetup="test-taint/<foo>/<bar>"
path("ClassView/", ClassView.as_view()), # $ routeSetup="ClassView/"
path("test-kwargs_param/<foo>/<bar>", kwargs_param), # $ routeSetup="test-kwargs_param/<foo>/<bar>"
]