mirror of
https://github.com/github/codeql.git
synced 2026-04-29 18:55:14 +02:00
Python: Modernise tornado library
This commit is contained in:
@@ -1,3 +1,4 @@
|
||||
| class DeepInheritance | test.py:23 |
|
||||
| class Handler1 | test.py:4 |
|
||||
| class Handler2 | test.py:8 |
|
||||
| class Handler3 | test.py:14 |
|
||||
|
||||
@@ -4,6 +4,6 @@ import python
|
||||
import semmle.python.TestUtils
|
||||
|
||||
import semmle.python.web.tornado.Tornado
|
||||
from ClassObject cls
|
||||
from ClassValue cls
|
||||
where cls = aTornadoRequestHandlerClass()
|
||||
select cls.toString(), remove_library_prefix(cls.getPyClass().getLocation())
|
||||
select cls.toString(), remove_library_prefix(cls.getScope().getLocation())
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
| test.py:6 | Attribute() | externally controlled string |
|
||||
| test.py:12 | name | externally controlled string |
|
||||
| test.py:20 | url | externally controlled string |
|
||||
| test.py:26 | Attribute() | externally controlled string |
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
| test.py:6 | Attribute() | externally controlled string |
|
||||
| test.py:10 | Attribute() | [externally controlled string] |
|
||||
| test.py:17 | Attribute | tornado.request.HttpRequest |
|
||||
| test.py:26 | Attribute() | externally controlled string |
|
||||
|
||||
@@ -9,3 +9,4 @@
|
||||
| test.py:19 | Subscript | externally controlled string |
|
||||
| test.py:19 | h | {externally controlled string} |
|
||||
| test.py:20 | url | externally controlled string |
|
||||
| test.py:26 | Attribute() | externally controlled string |
|
||||
|
||||
@@ -18,3 +18,9 @@ class Handler3(tornado.web.RequestHandler):
|
||||
h = req.headers
|
||||
url = h["url"]
|
||||
self.redirect(url)
|
||||
|
||||
|
||||
class DeepInheritance(Handler3):
|
||||
|
||||
def get(self):
|
||||
self.write(self.get_argument("also_xss"))
|
||||
|
||||
Reference in New Issue
Block a user