hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Fix tornado lib: a redirect is not a http response

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2020-01-28 12:51:50 +01:00
parent ee382bb2ea
commit 46f4b74134
6 changed files with 14 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
python/ql/src/semmle/python/web/tornado/Redirect.qll
View File

@@ -13,14 +13,16 @@ import Tornado
/**
* Represents an argument to the `tornado.redirect` function.
*/
class TornadoRedirect extends HttpRedirectTaintSink {
override string toString() { result = "tornado.redirect" }
class TornadoHttpRequestHandlerRedirect extends HttpRedirectTaintSink {
override string toString() { result = "tornado.HttpRequestHandler.redirect" }
TornadoRedirect() {
TornadoHttpRequestHandlerRedirect() {
exists(CallNode call, ControlFlowNode node |
node = call.getFunction().(AttrNode).getObject("redirect") and
isTornadoRequestHandlerInstance(node) and
this = call.getAnArg()
this = call.getArg(0)
)
}
override predicate sinks(TaintKind kind) { kind instanceof StringKind }
}

14
python/ql/src/semmle/python/web/tornado/Response.qll
View File

@@ -45,17 +45,3 @@ class TornadoHttpRequestHandlerWrite extends HttpResponseTaintSink {
override predicate sinks(TaintKind kind) { kind instanceof StringKind }
}
class TornadoHttpRequestHandlerRedirect extends HttpResponseTaintSink {
override string toString() { result = "tornado.HttpRequestHandler.redirect" }
TornadoHttpRequestHandlerRedirect() {
exists(CallNode call, ControlFlowNode node |
node = call.getFunction().(AttrNode).getObject("redirect") and
isTornadoRequestHandlerInstance(node) and
this = call.getArg(0)
)
}
override predicate sinks(TaintKind kind) { kind instanceof StringKind }
}

1
python/ql/test/library-tests/web/tornado/HttpRedirectSinks.expected Normal file
View File

@@ -0,0 +1 @@
| test.py:20:23:20:25 | tornado.HttpRequestHandler.redirect | externally controlled string |

7
python/ql/test/library-tests/web/tornado/HttpRedirectSinks.ql Normal file
View File

@@ -0,0 +1,7 @@
import python
import semmle.python.web.HttpRedirect
import semmle.python.security.strings.Untrusted
from HttpRedirectTaintSink sink, TaintKind kind
where sink.sinks(kind)
select sink, kind

1
python/ql/test/library-tests/web/tornado/HttpSinks.expected → python/ql/test/library-tests/web/tornado/HttpResponseSinks.expected
View File

@@ -1,4 +1,3 @@
| test.py:6:20:6:43 | tornado.HttpRequestHandler.write | externally controlled string |
| test.py:12:20:12:23 | tornado.HttpRequestHandler.write | externally controlled string |
| test.py:20:23:20:25 | tornado.HttpRequestHandler.redirect | externally controlled string |
| test.py:26:20:26:48 | tornado.HttpRequestHandler.write | externally controlled string |

0
python/ql/test/library-tests/web/tornado/HttpSinks.ql → python/ql/test/library-tests/web/tornado/HttpResponseSinks.ql
View File