Python: Modernise tornado library

This commit is contained in:
Rasmus Wriedt Larsen
2019-10-01 16:04:54 +02:00
parent 3e3833927b
commit 2bb933fef0
7 changed files with 21 additions and 12 deletions

View File

@@ -1,3 +1,4 @@
| class DeepInheritance | test.py:23 |
| class Handler1 | test.py:4 |
| class Handler2 | test.py:8 |
| class Handler3 | test.py:14 |

View File

@@ -4,6 +4,6 @@ import python
import semmle.python.TestUtils
import semmle.python.web.tornado.Tornado
from ClassObject cls
from ClassValue cls
where cls = aTornadoRequestHandlerClass()
select cls.toString(), remove_library_prefix(cls.getPyClass().getLocation())
select cls.toString(), remove_library_prefix(cls.getScope().getLocation())

View File

@@ -1,3 +1,4 @@
| test.py:6 | Attribute() | externally controlled string |
| test.py:12 | name | externally controlled string |
| test.py:20 | url | externally controlled string |
| test.py:26 | Attribute() | externally controlled string |

View File

@@ -1,3 +1,4 @@
| test.py:6 | Attribute() | externally controlled string |
| test.py:10 | Attribute() | [externally controlled string] |
| test.py:17 | Attribute | tornado.request.HttpRequest |
| test.py:26 | Attribute() | externally controlled string |

View File

@@ -9,3 +9,4 @@
| test.py:19 | Subscript | externally controlled string |
| test.py:19 | h | {externally controlled string} |
| test.py:20 | url | externally controlled string |
| test.py:26 | Attribute() | externally controlled string |

View File

@@ -18,3 +18,9 @@ class Handler3(tornado.web.RequestHandler):
h = req.headers
url = h["url"]
self.redirect(url)
class DeepInheritance(Handler3):
def get(self):
self.write(self.get_argument("also_xss"))