mirror of
https://github.com/github/codeql.git
synced 2026-01-06 19:20:25 +01:00
Python: Fix Flask jsonify XSS regression
The reason the result was found before, is that `jsonify(data)` was modeled as TWO separate subclasses of `Http::Server::HttpResponse`, one because of the implicit construction in return (FlaskRouteHandlerReturn), and one from the `jsonify` call (FlaskJsonifyCall). Due to the QL evaluation, we got a combination from the two, meaning mime-type from FlaskRouteHandlerReturn and body from FlaskJsonifyCall...
This commit is contained in:
@@ -453,7 +453,8 @@ module Flask {
|
||||
FlaskRouteHandlerReturn() {
|
||||
exists(Function routeHandler |
|
||||
routeHandler = any(FlaskRouteSetup rs).getARequestHandler() and
|
||||
node = routeHandler.getAReturnValueFlowNode()
|
||||
node = routeHandler.getAReturnValueFlowNode() and
|
||||
not this instanceof Flask::Response::InstanceSource
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user