PR init

python/ql/test/experimental/query-tests/Security/CWE-943/NoSQLInjectio.qlref

@@ -0,0 +1 @@
+experimental/Security/CWE-943/RegexInjection.ql

python/ql/test/experimental/query-tests/Security/CWE-943/flask_mongoengine_bad.py

@@ -0,0 +1,30 @@
+from flask import Flask, request
+from flask_mongoengine import MongoEngine
+import mongoengine as me
+import json
+
+app = Flask(__name__)
+db = MongoEngine(app)
+
+
+class Movie(me.Document):
+    title = me.StringField(required=True)
+    year = me.IntField()
+    rated = me.StringField()
+    director = me.StringField()
+    actors = me.ListField()
+
+
+Movie(title='aa').save()
+Movie(title='bb').save()
+
+
+@app.route("/")
+def home_page():
+    unsanitized_search = json.loads(request.args['search'])
+
+    data = Movie.objects(title=unsanitized_search)
+    return data.to_json()
+
+# if __name__ == "__main__":
+#     app.run(debug=True)

python/ql/test/experimental/query-tests/Security/CWE-943/flask_mongoengine_good.py

@@ -0,0 +1,32 @@
+from flask import Flask, request
+from flask_mongoengine import MongoEngine
+import mongoengine as me
+from mongosanitizer.sanitizer import sanitize
+import json
+
+app = Flask(__name__)
+db = MongoEngine(app)
+
+
+class Movie(me.Document):
+    title = me.StringField(required=True)
+    year = me.IntField()
+    rated = me.StringField()
+    director = me.StringField()
+    actors = me.ListField()
+
+
+Movie(title='aa').save()
+Movie(title='bb').save()
+
+
+@app.route("/")
+def home_page():
+    unsanitized_search = json.loads(request.args['search'])
+    sanitize(unsanitized_search)
+
+    data = Movie.objects(title=unsanitized_search)
+    return data.to_json()
+
+# if __name__ == "__main__":
+#     app.run(debug=True)

python/ql/test/experimental/query-tests/Security/CWE-943/flask_pymongo_bad.py

@@ -0,0 +1,18 @@
+from flask import Flask, request
+from flask_pymongo import PyMongo
+import json
+
+app = Flask(__name__)
+app.config["MONGO_URI"] = "mongodb://localhost:27017/testdb"
+mongo = PyMongo(app)
+
+
+@app.route("/")
+def home_page():
+    unsanitized_search = json.loads(request.args['search'])
+
+    db_results = mongo.db.user.find({'name': unsanitized_search})
+    return db_results[0].keys()
+
+# if __name__ == "__main__":
+#     app.run(debug=True)

python/ql/test/experimental/query-tests/Security/CWE-943/flask_pymongo_good.py

@@ -0,0 +1,20 @@
+from flask import Flask, request
+from flask_pymongo import PyMongo
+from mongosanitizer.sanitizer import sanitize
+import json
+
+app = Flask(__name__)
+app.config["MONGO_URI"] = "mongodb://localhost:27017/testdb"
+mongo = PyMongo(app)
+
+
+@app.route("/")
+def home_page():
+    unsanitized_search = json.loads(request.args['search'])
+    sanitize(unsanitized_search)
+
+    db_results = mongo.db.user.find({'name': unsanitized_search})
+    return db_results[0].keys()
+
+# if __name__ == "__main__":
+#    app.run(debug=True)