hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

clean up unused vars,fix tests

Browse Source
This commit is contained in:
amammad
2023-10-09 23:15:58 +02:00
parent 9d86e7946c
commit 4283bb7d48
6 changed files with 201 additions and 473 deletions
Download Patch File Download Diff File Expand all files Collapse all files

76
python/ql/test/experimental/query-tests/Security/CWE-409/test.py Normal file
View File

@@ -0,0 +1,76 @@
import tarfile
import zipfile
from fastapi import FastAPI
app = FastAPI()
@app.post("/bomb")
async def bomb(file_path):
zipfile.ZipFile(file_path, "r").extract("file1")
zipfile.ZipFile(file_path, "r").extractall()
with zipfile.ZipFile(file_path) as myzip:
with myzip.open('ZZ') as myfile:
a = myfile.readline()
with zipfile.ZipFile(file_path) as myzip:
with myzip.open('ZZ', mode="w") as myfile:
myfile.write(b"tmpppp")
zipfile.ZipFile(file_path).read("aFileNameInTheZipFile")
tarfile.open(file_path).extractfile("file1.txt")
tarfile.TarFile.open(file_path).extract("somefile")
tarfile.TarFile.xzopen(file_path).extract("somefile")
tarfile.TarFile.gzopen(file_path).extractall()
tarfile.TarFile.open(file_path).extractfile("file1.txt")
tarfile.open(file_path, mode="w")
tarfile.TarFile.gzopen(file_path, mode="w")
tarfile.TarFile.open(file_path, mode="r:")
import shutil
shutil.unpack_archive(file_path)
import lzma
lzma.open(file_path)
lzma.LZMAFile(file_path).read()
import bz2
bz2.open(file_path)
bz2.BZ2File(file_path).read()
import gzip
gzip.open(file_path)
gzip.GzipFile(file_path)
import pandas
pandas.read_csv(filepath_or_buffer=file_path)
pandas.read_table(file_path, compression='gzip')
pandas.read_xml(file_path, compression='gzip')
pandas.read_csv(filepath_or_buffer=file_path, compression='gzip')
pandas.read_json(file_path, compression='gzip')
pandas.read_sas(file_path, compression='gzip')
pandas.read_stata(filepath_or_buffer=file_path, compression='gzip')
pandas.read_table(file_path, compression='gzip')
pandas.read_xml(path_or_buffer=file_path, compression='gzip')
# no compression no DOS
pandas.read_table(file_path, compression='tar')
pandas.read_xml(file_path, compression='tar')
pandas.read_csv(filepath_or_buffer=file_path, compression='tar')
pandas.read_json(file_path, compression='tar')
pandas.read_sas(file_path, compression='tar')
pandas.read_stata(filepath_or_buffer=file_path, compression='tar')
pandas.read_table(file_path, compression='tar')
pandas.read_xml(path_or_buffer=file_path, compression='tar')
return {"message": "bomb"}