mirror of
https://github.com/github/codeql.git
synced 2026-05-03 12:45:27 +02:00
Python: Don't consider has_body tainted
Although it technically is, I think it belong in the section of things that are unlikely to be exploitable
This commit is contained in:
@@ -224,9 +224,8 @@ module AiohttpWebModel {
|
||||
nodeTo.(DataFlow::AttrRead).getObject() = nodeFrom and
|
||||
nodeTo.(DataFlow::AttrRead).getAttributeName() in [
|
||||
"url", "rel_url", "forwarded", "host", "remote", "path", "path_qs", "raw_path", "query",
|
||||
"headers", "transport", "cookies", "content", "_payload", "body_exists", "has_body",
|
||||
"content_type", "charset", "http_range", "if_modified_since", "if_unmodified_since",
|
||||
"if_range"
|
||||
"headers", "transport", "cookies", "content", "_payload", "content_type", "charset",
|
||||
"http_range", "if_modified_since", "if_unmodified_since", "if_range"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@@ -66,9 +66,6 @@ async def test_taint(request: web.Request): # $ requestHandler
|
||||
request.content, # $ tainted
|
||||
request._payload, # $ tainted
|
||||
|
||||
request.body_exists, # $ tainted
|
||||
request.has_body, # $ tainted
|
||||
|
||||
request.content_type, # $ tainted
|
||||
request.charset, # $ tainted
|
||||
|
||||
@@ -116,6 +113,9 @@ async def test_taint(request: web.Request): # $ requestHandler
|
||||
request.keep_alive,
|
||||
|
||||
request.content_length,
|
||||
request.body_exists,
|
||||
request.has_body,
|
||||
request.can_read_body,
|
||||
)
|
||||
|
||||
ensure_not_tainted(
|
||||
|
||||
Reference in New Issue
Block a user