hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 20:25:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add required __raw__ keyword

Browse Source 
This __raw__ keyword is required for the actual mongoengine vulnerability. More info can be found below:

http://docs.mongoengine.org/guide/querying.html?highlight=inc__#raw-queries
This commit is contained in:
thank_you
2021-04-05 19:07:13 -04:00
parent 80216f6974
commit 3f0c758622
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
python/ql/test/experimental/query-tests/Security/CWE-943/flask_mongoengine_bad.py
View File

@@ -23,7 +23,7 @@ Movie(title='bb').save()
def home_page():
unsanitized_search = json.loads(request.args['search'])
data = Movie.objects(unsanitized_search)
data = Movie.objects(__raw__=unsanitized_search)
return data.to_json()
# if __name__ == "__main__":

2
python/ql/test/experimental/query-tests/Security/CWE-943/flask_mongoengine_good.py
View File

@@ -25,7 +25,7 @@ def home_page():
unsanitized_search = json.loads(request.args['search'])
sanitize(unsanitized_search)
data = Movie.objects(unsanitized_search)
data = Movie.objects(__raw__=unsanitized_search)
return data.to_json()
# if __name__ == "__main__":