hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 11:16:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Polish tests

Browse Source
This commit is contained in:
jorgectf
2021-07-24 02:09:23 +02:00
parent 0d2646fd3d
commit 61e873d725
2 changed files with 47 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
python/ql/test/experimental/query-tests/Security/CWE-611/general.py
View File

@@ -10,49 +10,64 @@ import xmltodict
app = Flask(__name__)
# xml_content = '<?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>'
@app.route("/XMLParser-Empty&xml.etree.ElementTree.fromstring")
def test1():
# <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
@app.route("/lxml.etree.fromstring")
def lxml_fromstring():
xml_content = request.args['xml_content']
parser = lxml.etree.XMLParser()
# 'root...'
return xml.etree.ElementTree.fromstring(xml_content, parser=parser).text
return lxml.etree.fromstring(xml_content).text
@app.route("/XMLParser-Empty&xml.etree.ElementTree.parse")
def test1():
# <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
@app.route("/lxml.etree.XML")
def lxml_XML():
xml_content = request.args['xml_content']
parser = lxml.etree.XMLParser()
# 'jorgectf'
return xml.etree.ElementTree.parse(StringIO(xml_content), parser=parser).getroot().text
return lxml.etree.XML(xml_content).text
@app.route("/XMLParser-Empty&lxml.etree.fromstring")
def test1():
# <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
@app.route("/lxml.etree.parse")
def lxml_parse():
xml_content = request.args['xml_content']
parser = lxml.etree.XMLParser()
return lxml.etree.fromstring(xml_content, parser=parser).text # 'jorgectf'
return lxml.etree.parse(StringIO(xml_content)).text
@app.route("/XMLParser-Empty&xml.etree.parse")
def test1():
# <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
xml_content = request.args['xml_content']
parser = lxml.etree.XMLParser()
# 'jorgectf'
return lxml.etree.parse(StringIO(xml_content), parser=parser).getroot().text
@app.route("/xmltodict-disable_entities_False")
def test2():
# <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
@app.route("/xmltodict.parse")
def xmltodict_parse():
xml_content = request.args['xml_content']
return xmltodict.parse(xml_content, disable_entities=False)
@app.route("/lxml.etree.XMLParser+lxml.etree.fromstring")
def test1():
xml_content = request.args['xml_content']
parser = lxml.etree.XMLParser()
return lxml.etree.fromstring(xml_content, parser=parser).text
@app.route("/lxml.etree.get_default_parser+lxml.etree.fromstring")
def test1():
xml_content = request.args['xml_content']
parser = lxml.etree.get_default_parser()
return lxml.etree.fromstring(xml_content, parser=parser).text
@app.route("/lxml.etree.XMLParser+xml.etree.ElementTree.fromstring")
def test1():
xml_content = request.args['xml_content']
parser = lxml.etree.XMLParser()
return xml.etree.ElementTree.fromstring(xml_content, parser=parser).text
@app.route("/lxml.etree.XMLParser+xml.etree.ElementTree.parse")
def test1():
xml_content = request.args['xml_content']
parser = lxml.etree.XMLParser()
return xml.etree.ElementTree.parse(StringIO(xml_content), parser=parser).getroot().text

9
python/ql/test/experimental/query-tests/Security/CWE-611/xml_sax_make_parser.py
View File

@@ -2,11 +2,10 @@ from flask import request, Flask
from io import StringIO
import xml.sax
# xml_content = '<?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>'
app = Flask(__name__)
# https://docs.python.org/3/library/xml.sax.handler.html#xml.sax.handler.feature_external_ges
class MainHandler(xml.sax.ContentHandler):
def __init__(self):
@@ -24,7 +23,6 @@ class MainHandler(xml.sax.ContentHandler):
@app.route("/MainHandler")
def test1():
# <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
xml_content = request.args['xml_content']
return MainHandler().parse(StringIO(xml_content))
@@ -32,7 +30,6 @@ def test1():
@app.route("/xml.sax.make_parser()+MainHandler")
def test1():
# <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
xml_content = request.args['xml_content']
BadHandler = MainHandler()
@@ -44,12 +41,12 @@ def test1():
@app.route("/xml.sax.make_parser()+MainHandler-xml.sax.handler.feature_external_ges_False")
def test1():
# <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
xml_content = request.args['xml_content']
BadHandler = MainHandler()
parser = xml.sax.make_parser()
parser.setContentHandler(BadHandler)
# https://docs.python.org/3/library/xml.sax.handler.html#xml.sax.handler.feature_external_ges
parser.setFeature(xml.sax.handler.feature_external_ges, False)
parser.parse(StringIO(xml_content))
return BadHandler._result
@@ -59,7 +56,6 @@ def test1():
@app.route("/xml.sax.make_parser()+MainHandler-xml.sax.handler.feature_external_ges_True")
def test1():
# <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
xml_content = request.args['xml_content']
GoodHandler = MainHandler()
@@ -72,7 +68,6 @@ def test1():
@app.route("/xml.sax.make_parser()+xml.dom.minidom.parse-xml.sax.handler.feature_external_ges_True")
def test1():
# <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
xml_content = request.args['xml_content']
parser = xml.sax.make_parser()