Python: Restore rest of experimental files

python/ql/src/experimental/Security/CWE-074/JinjaBad.py

@@ -0,0 +1,19 @@
+from django.urls import path
+from django.http import HttpResponse
+from jinja2 import Template as Jinja2_Template
+from jinja2 import Environment, DictLoader, escape
+
+
+def a(request):
+    # Load the template
+    template = request.GET['template']
+    t = Jinja2_Template(template)
+    name = request.GET['name']
+    # Render the template with the context data
+    html = t.render(name=escape(name))
+    return HttpResponse(html)
+
+
+urlpatterns = [
+    path('a', a),
+]

python/ql/src/experimental/Security/CWE-074/JinjaGood.py

@@ -0,0 +1,20 @@
+from django.urls import path
+from django.http import HttpResponse
+from jinja2 import Template as Jinja2_Template
+from jinja2 import Environment, DictLoader, escape
+
+
+def a(request):
+    # Load the template
+    template = request.GET['template']
+    env = SandboxedEnvironment(undefined=StrictUndefined)
+    t = env.from_string(template)
+    name = request.GET['name']
+    # Render the template with the context data
+    html = t.render(name=escape(name))
+    return HttpResponse(html)
+
+
+urlpatterns = [
+    path('a', a),
+]

python/ql/test/experimental/semmle/python/templates/Airspeed.py

@@ -0,0 +1,10 @@
+from bottle import Bottle, route, request, redirect, response
+import airspeed
+
+
+app = Bottle()
+
+
+@route('/other')
+def a():
+    return airspeed.Template("sink")

python/ql/test/experimental/semmle/python/templates/AirspeedSSTISinks.expected

@@ -0,0 +1,2 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (AirspeedSSTISinks.ql:4,6-14)
+| Airspeed.py:10:30:10:35 | argument to airspeed.Template() |

python/ql/test/experimental/semmle/python/templates/AirspeedSSTISinks.ql

@@ -0,0 +1,5 @@
+import python
+import experimental.semmle.python.templates.Airspeed
+
+from SSTISink s
+select s

python/ql/test/experimental/semmle/python/templates/Bottle.py

@@ -0,0 +1,17 @@
+from bottle import Bottle, route, request, redirect, response, SimpleTemplate
+from bottle import template as temp
+
+
+app = Bottle()
+
+
+@route('/other')
+def a():
+    template = "test"
+    tpl = SimpleTemplate(template)
+
+
+@route('/other2')
+def b():
+    template = "test"
+    return temp(template, name='World')

python/ql/test/experimental/semmle/python/templates/BottleSSTISinks.expected

@@ -0,0 +1,3 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (BottleSSTISinks.ql:4,6-14)
+| Bottle.py:11:26:11:33 | argument to bottle.SimpleTemplate() |
+| Bottle.py:17:17:17:24 | argument to bottle.template() |

python/ql/test/experimental/semmle/python/templates/BottleSSTISinks.ql

@@ -0,0 +1,5 @@
+import python
+import experimental.semmle.python.templates.Bottle
+
+from SSTISink s
+select s

python/ql/test/experimental/semmle/python/templates/Chameleon.py

@@ -0,0 +1,5 @@
+from chameleon import PageTemplate
+
+
+def chameleon():
+    template = PageTemplate("sink")

python/ql/test/experimental/semmle/python/templates/ChameleonSSTISinks.expected

@@ -0,0 +1,2 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (ChameleonSSTISinks.ql:4,6-14)
+| Chameleon.py:5:29:5:34 | argument to Chameleon.PageTemplate() |

python/ql/test/experimental/semmle/python/templates/ChameleonSSTISinks.ql

@@ -0,0 +1,5 @@
+import python
+import experimental.semmle.python.templates.Chameleon
+
+from SSTISink s
+select s

python/ql/test/experimental/semmle/python/templates/CheetahSSTISinks.expected

@@ -0,0 +1,3 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (CheetahSSTISinks.ql:4,6-14)
+| CheetahSinks.py:10:21:10:26 | argument to Cheetah.Template.Template() |
+| CheetahSinks.py:20:20:20:25 | argument to Cheetah.Template.Template() |

python/ql/test/experimental/semmle/python/templates/CheetahSSTISinks.ql

@@ -0,0 +1,5 @@
+import python
+import experimental.semmle.python.templates.Cheetah
+
+from SSTISink s
+select s

python/ql/test/experimental/semmle/python/templates/CheetahSinks.py

@@ -0,0 +1,20 @@
+from bottle import Bottle, route, request, redirect, response, SimpleTemplate
+from Cheetah.Template import Template
+
+
+app = Bottle()
+
+
+@route('/other')
+def a():
+    return Template("sink")
+
+
+class Template3(Template):
+    title = 'Hello World Example!'
+    contents = 'Hello World!'
+
+
+@route('/other2')
+def b():
+    t3 = Template3("sink")

python/ql/test/experimental/semmle/python/templates/ChevronSSTISinks.expected

@@ -0,0 +1,2 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (ChevronSSTISinks.ql:4,6-14)
+| ChevronSinks.py:10:27:10:32 | argument to chevron.render() |

python/ql/test/experimental/semmle/python/templates/ChevronSSTISinks.ql

@@ -0,0 +1,5 @@
+import python
+import experimental.semmle.python.templates.Chevron
+
+from SSTISink s
+select s

python/ql/test/experimental/semmle/python/templates/ChevronSinks.py

@@ -0,0 +1,22 @@
+from bottle import Bottle, route, request, redirect, response, SimpleTemplate
+import chevron
+
+
+app = Bottle()
+
+
+@route('/other')
+def a():
+    return chevron.render("sink", {"key": "value"})
+
+
+@route('/other2')
+def b():
+    sink = {
+        'template': "template",
+
+        'data': {
+            'key': 'value'
+        }
+    }
+    return chevron.render(**sink)

python/ql/test/experimental/semmle/python/templates/DjangoSSTISinks.expected

@@ -0,0 +1,2 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (DjangoSSTISinks.ql:4,6-14)
+| DjangoTemplates.py:9:18:9:25 | argument to Django.template() |

python/ql/test/experimental/semmle/python/templates/DjangoSSTISinks.ql

@@ -0,0 +1,5 @@
+import python
+import experimental.semmle.python.templates.DjangoTemplate
+
+from SSTISink s
+select s

python/ql/test/experimental/semmle/python/templates/DjangoTemplates.py

@@ -0,0 +1,39 @@
+from django.urls import path
+from django.http import HttpResponse
+from django.template import Template, Context, Engine, engines
+
+
+def dj(request):
+    # Load the template
+    template = request.GET['template']
+    t = Template(template)
+    ctx = Context(locals())
+    html = t.render(ctx)
+    return HttpResponse(html)
+
+
+def djEngine(request):
+    # Load the template
+    template = request.GET['template']
+
+    django_engine = engines['django']
+    t = django_engine.from_string(template)
+    ctx = Context(locals())
+    html = t.render(ctx)
+    return HttpResponse(html)
+
+
+def djEngineJinja(request):
+    # Load the template
+    template = request.GET['template']
+
+    django_engine = engines['jinja']
+    t = django_engine.from_string(template)
+    ctx = Context(locals())
+    html = t.render(ctx)
+    return HttpResponse(html)
+
+
+urlpatterns = [
+    path('', dj)
+]

python/ql/test/experimental/semmle/python/templates/Genshi.py

@@ -0,0 +1,10 @@
+
+
+def genshi1():
+    from genshi.template import MarkupTemplate
+    tmpl = MarkupTemplate('sink')
+
+
+def genshi2():
+    from genshi.template import TextTemplate
+    tmpl = TextTemplate('sink')

python/ql/test/experimental/semmle/python/templates/GenshiSSTISinks.expected

@@ -0,0 +1,3 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (GenshiSSTISinks.ql:4,6-14)
+| Genshi.py:5:27:5:32 | argument to genshi.template.MarkupTemplate() |
+| Genshi.py:10:25:10:30 | argument to genshi.template.TextTemplate() |

python/ql/test/experimental/semmle/python/templates/GenshiSSTISinks.ql

@@ -0,0 +1,5 @@
+import python
+import experimental.semmle.python.templates.Genshi
+
+from SSTISink s
+select s

python/ql/test/experimental/semmle/python/templates/Jinja2Templates.py

@@ -0,0 +1,17 @@
+from jinja2 import Template as Jinja2_Template
+from jinja2 import Environment, DictLoader, escape
+
+
+def jinja():
+    t = Jinja2_Template("sink")
+
+
+def jinja2():
+    random = "esdad" + "asdad"
+    t = Jinja2_Template(random)
+
+
+def jinja3():
+    random = 1234
+    t = Jinja2_Template("sink"+random)
+

python/ql/test/experimental/semmle/python/templates/JinjaSSTISinks.expected

@@ -0,0 +1,4 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (JinjaSSTISinks.ql:4,6-14)
+| Jinja2Templates.py:6:25:6:30 | argument to jinja2.Template() |
+| Jinja2Templates.py:11:25:11:30 | argument to jinja2.Template() |
+| Jinja2Templates.py:16:25:16:37 | argument to jinja2.Template() |

python/ql/test/experimental/semmle/python/templates/JinjaSSTISinks.ql

@@ -0,0 +1,5 @@
+import python
+import experimental.semmle.python.templates.Jinja
+
+from SSTISink s
+select s

python/ql/test/experimental/semmle/python/templates/Mako.py

@@ -0,0 +1,5 @@
+
+
+def mako():
+    from mako.template import Template
+    mytemplate = Template("sink")

python/ql/test/experimental/semmle/python/templates/MakoSSTISinks.expected

@@ -0,0 +1,2 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (MakoSSTISinks.ql:4,6-14)
+| Mako.py:5:27:5:32 | argument to mako.template.Template() |

python/ql/test/experimental/semmle/python/templates/MakoSSTISinks.ql

@@ -0,0 +1,5 @@
+import python
+import experimental.semmle.python.templates.Mako
+
+from SSTISink s
+select s

python/ql/test/experimental/semmle/python/templates/TRender.py

@@ -0,0 +1,6 @@
+
+
+def trender():
+    from trender import TRender
+    template = '@greet world!'
+    compiled = TRender(template)

python/ql/test/experimental/semmle/python/templates/TRenderSSTISinks.expected

@@ -0,0 +1,2 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (TRenderSSTISinks.ql:4,6-14)
+| TRender.py:6:24:6:31 | argument to trender.TRender() |

python/ql/test/experimental/semmle/python/templates/TRenderSSTISinks.ql

@@ -0,0 +1,5 @@
+import python
+import experimental.semmle.python.templates.TRender
+
+from SSTISink s
+select s

python/ql/test/experimental/semmle/python/templates/options

@@ -0,0 +1 @@
+semmle-extractor-options: --lang=3 --max-import-depth=3 -p ../../../../../query-tests/Security/lib/