hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Fix DataflowQueryTest

Browse Source 
You're only allowed to have `result=OK` if there is a sink on that line...
This commit is contained in:
Rasmus Wriedt Larsen
2024-02-14 15:44:40 +01:00
parent cd596f5d05
commit 59014787a1
2 changed files with 15 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
python/ql/test/experimental/query-tests/Security/CWE-409/DataflowQueryTest.expected Normal file
View File

@@ -0,0 +1,3 @@
missingAnnotationOnSink
testFailures
failures

24
python/ql/test/experimental/query-tests/Security/CWE-409/test.py
View File

@@ -15,7 +15,7 @@ async def bomb(file_path):
a = myfile.readline()
with zipfile.ZipFile(file_path) as myzip:
with myzip.open('ZZ', mode="w") as myfile: # $result=OK
with myzip.open('ZZ', mode="w") as myfile: # $ SPURIOUS: result=BAD
myfile.write(b"tmpppp")
zipfile.ZipFile(file_path).read("aFileNameInTheZipFile") # $ result=BAD
@@ -26,9 +26,9 @@ async def bomb(file_path):
tarfile.TarFile.gzopen(file_path).extractall() # $ result=BAD
tarfile.TarFile.open(file_path).extractfile("file1.txt") # $ result=BAD
tarfile.open(file_path, mode="w") # $result=OK
tarfile.TarFile.gzopen(file_path, mode="w") # $result=OK
tarfile.TarFile.open(file_path, mode="r:") # $ result=BAD
tarfile.open(file_path, mode="w") # ok, writing
tarfile.TarFile.gzopen(file_path, mode="w") # ok, writing
tarfile.TarFile.open(file_path, mode="r:") # potential problem, depending on usage
import shutil
shutil.unpack_archive(file_path) # $ result=BAD
@@ -63,14 +63,14 @@ async def bomb(file_path):
pandas.read_xml(path_or_buffer=file_path, compression='gzip') # $ result=BAD
# no compression no DOS
pandas.read_table(file_path, compression='tar') # $result=OK
pandas.read_xml(file_path, compression='tar') # $result=OK
pandas.read_table(file_path, compression='tar')
pandas.read_xml(file_path, compression='tar')
pandas.read_csv(filepath_or_buffer=file_path, compression='tar') # $result=OK
pandas.read_json(file_path, compression='tar') # $result=OK
pandas.read_sas(file_path, compression='tar') # $result=OK
pandas.read_stata(filepath_or_buffer=file_path, compression='tar') # $result=OK
pandas.read_table(file_path, compression='tar') # $result=OK
pandas.read_xml(path_or_buffer=file_path, compression='tar') # $result=OK
pandas.read_csv(filepath_or_buffer=file_path, compression='tar')
pandas.read_json(file_path, compression='tar')
pandas.read_sas(file_path, compression='tar')
pandas.read_stata(filepath_or_buffer=file_path, compression='tar')
pandas.read_table(file_path, compression='tar')
pandas.read_xml(path_or_buffer=file_path, compression='tar')
return {"message": "bomb"}