hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 13:45:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: rest_framework.decorators.api_view handling

Browse Source 
Had to expose even more things, and had to make the `DjangoRouteHandler`
modeling more flexible so I could extend the char-pred in a different
file.
This commit is contained in:
Rasmus Wriedt Larsen
2021-10-29 14:43:54 +02:00
parent 222db37c0d
commit 57e13c6066
3 changed files with 61 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
python/ql/test/library-tests/frameworks/rest_framework/taint_test.py
View File

@@ -119,8 +119,11 @@ urlpatterns = [
# framework
@api_view(["POST"])
def function_based_no_route(request: Request, possible_routed_param):
ensure_tainted(request, possible_routed_param) # $ MISSING: tainted
def function_based_no_route(request: Request, possible_routed_param): # $ requestHandler routedParameter=possible_routed_param
ensure_tainted(
request, # $ MISSING: tainted
possible_routed_param, # $ tainted
)
class ClassBasedNoRoute(APIView):