hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Fix SSRF sanitizer tests

Browse Source 
They were very misleading before, because a sanitizer that happened
early, would remove taint from the rest of the cases by use-use flow :|
This commit is contained in:
Rasmus Wriedt Larsen
2021-12-16 23:21:26 +01:00
parent 4b5599fe17
commit 6f297f4e9c
3 changed files with 245 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files

135
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/FullServerSideRequestForgery.expected
View File

@@ -10,30 +10,58 @@ edges
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:13:18:13:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:19:18:19:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:23:18:23:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:28:18:28:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:31:18:31:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:34:18:34:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:39:18:39:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:42:18:42:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:44:38:44:58 | ControlFlowNode for Tuple |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:50:18:50:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:53:18:53:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:56:18:56:20 | ControlFlowNode for url |
| full_partial_test.py:8:17:8:23 | ControlFlowNode for request | full_partial_test.py:8:17:8:28 | ControlFlowNode for Attribute |
| full_partial_test.py:8:17:8:28 | ControlFlowNode for Attribute | full_partial_test.py:8:17:8:41 | ControlFlowNode for Subscript |
| full_partial_test.py:8:17:8:41 | ControlFlowNode for Subscript | full_partial_test.py:23:18:23:20 | ControlFlowNode for url |
| full_partial_test.py:8:17:8:41 | ControlFlowNode for Subscript | full_partial_test.py:34:18:34:20 | ControlFlowNode for url |
| full_partial_test.py:8:17:8:41 | ControlFlowNode for Subscript | full_partial_test.py:44:38:44:58 | ControlFlowNode for Tuple |
| full_partial_test.py:8:17:8:41 | ControlFlowNode for Subscript | full_partial_test.py:56:18:56:20 | ControlFlowNode for url |
| full_partial_test.py:44:38:44:58 | ControlFlowNode for Tuple | full_partial_test.py:45:18:45:20 | ControlFlowNode for url |
| full_partial_test.py:60:18:60:24 | ControlFlowNode for request | full_partial_test.py:60:18:60:29 | ControlFlowNode for Attribute |
| full_partial_test.py:60:18:60:29 | ControlFlowNode for Attribute | full_partial_test.py:60:18:60:48 | ControlFlowNode for Subscript |
| full_partial_test.py:60:18:60:48 | ControlFlowNode for Subscript | full_partial_test.py:63:18:63:20 | ControlFlowNode for url |
| full_partial_test.py:60:18:60:48 | ControlFlowNode for Subscript | full_partial_test.py:66:18:66:20 | ControlFlowNode for url |
| full_partial_test.py:60:18:60:48 | ControlFlowNode for Subscript | full_partial_test.py:69:18:69:20 | ControlFlowNode for url |
| full_partial_test.py:60:18:60:48 | ControlFlowNode for Subscript | full_partial_test.py:72:18:72:20 | ControlFlowNode for url |
| full_partial_test.py:60:18:60:48 | ControlFlowNode for Subscript | full_partial_test.py:78:18:78:20 | ControlFlowNode for url |
| full_partial_test.py:60:18:60:48 | ControlFlowNode for Subscript | full_partial_test.py:81:18:81:20 | ControlFlowNode for url |
| full_partial_test.py:30:18:30:24 | ControlFlowNode for request | full_partial_test.py:30:18:30:29 | ControlFlowNode for Attribute |
| full_partial_test.py:30:18:30:24 | ControlFlowNode for request | full_partial_test.py:31:17:31:23 | ControlFlowNode for request |
| full_partial_test.py:30:18:30:24 | ControlFlowNode for request | full_partial_test.py:31:17:31:28 | ControlFlowNode for Attribute |
| full_partial_test.py:30:18:30:29 | ControlFlowNode for Attribute | full_partial_test.py:30:18:30:48 | ControlFlowNode for Subscript |
| full_partial_test.py:30:18:30:48 | ControlFlowNode for Subscript | full_partial_test.py:35:18:35:20 | ControlFlowNode for url |
| full_partial_test.py:30:18:30:48 | ControlFlowNode for Subscript | full_partial_test.py:38:18:38:20 | ControlFlowNode for url |
| full_partial_test.py:30:18:30:48 | ControlFlowNode for Subscript | full_partial_test.py:41:18:41:20 | ControlFlowNode for url |
| full_partial_test.py:31:17:31:23 | ControlFlowNode for request | full_partial_test.py:31:17:31:28 | ControlFlowNode for Attribute |
| full_partial_test.py:31:17:31:28 | ControlFlowNode for Attribute | full_partial_test.py:31:17:31:41 | ControlFlowNode for Subscript |
| full_partial_test.py:31:17:31:41 | ControlFlowNode for Subscript | full_partial_test.py:41:18:41:20 | ControlFlowNode for url |
| full_partial_test.py:44:18:44:24 | ControlFlowNode for request | full_partial_test.py:44:18:44:29 | ControlFlowNode for Attribute |
| full_partial_test.py:44:18:44:24 | ControlFlowNode for request | full_partial_test.py:45:17:45:23 | ControlFlowNode for request |
| full_partial_test.py:44:18:44:24 | ControlFlowNode for request | full_partial_test.py:45:17:45:28 | ControlFlowNode for Attribute |
| full_partial_test.py:44:18:44:29 | ControlFlowNode for Attribute | full_partial_test.py:44:18:44:48 | ControlFlowNode for Subscript |
| full_partial_test.py:44:18:44:48 | ControlFlowNode for Subscript | full_partial_test.py:49:18:49:20 | ControlFlowNode for url |
| full_partial_test.py:44:18:44:48 | ControlFlowNode for Subscript | full_partial_test.py:52:18:52:20 | ControlFlowNode for url |
| full_partial_test.py:44:18:44:48 | ControlFlowNode for Subscript | full_partial_test.py:54:38:54:58 | ControlFlowNode for Tuple |
| full_partial_test.py:45:17:45:23 | ControlFlowNode for request | full_partial_test.py:45:17:45:28 | ControlFlowNode for Attribute |
| full_partial_test.py:45:17:45:28 | ControlFlowNode for Attribute | full_partial_test.py:45:17:45:41 | ControlFlowNode for Subscript |
| full_partial_test.py:45:17:45:41 | ControlFlowNode for Subscript | full_partial_test.py:54:38:54:58 | ControlFlowNode for Tuple |
| full_partial_test.py:54:38:54:58 | ControlFlowNode for Tuple | full_partial_test.py:55:18:55:20 | ControlFlowNode for url |
| full_partial_test.py:58:18:58:24 | ControlFlowNode for request | full_partial_test.py:58:18:58:29 | ControlFlowNode for Attribute |
| full_partial_test.py:58:18:58:24 | ControlFlowNode for request | full_partial_test.py:59:17:59:23 | ControlFlowNode for request |
| full_partial_test.py:58:18:58:24 | ControlFlowNode for request | full_partial_test.py:59:17:59:28 | ControlFlowNode for Attribute |
| full_partial_test.py:58:18:58:29 | ControlFlowNode for Attribute | full_partial_test.py:58:18:58:48 | ControlFlowNode for Subscript |
| full_partial_test.py:58:18:58:48 | ControlFlowNode for Subscript | full_partial_test.py:63:18:63:20 | ControlFlowNode for url |
| full_partial_test.py:58:18:58:48 | ControlFlowNode for Subscript | full_partial_test.py:66:18:66:20 | ControlFlowNode for url |
| full_partial_test.py:58:18:58:48 | ControlFlowNode for Subscript | full_partial_test.py:69:18:69:20 | ControlFlowNode for url |
| full_partial_test.py:59:17:59:23 | ControlFlowNode for request | full_partial_test.py:59:17:59:28 | ControlFlowNode for Attribute |
| full_partial_test.py:59:17:59:28 | ControlFlowNode for Attribute | full_partial_test.py:59:17:59:41 | ControlFlowNode for Subscript |
| full_partial_test.py:59:17:59:41 | ControlFlowNode for Subscript | full_partial_test.py:69:18:69:20 | ControlFlowNode for url |
| full_partial_test.py:73:18:73:24 | ControlFlowNode for request | full_partial_test.py:73:18:73:29 | ControlFlowNode for Attribute |
| full_partial_test.py:73:18:73:29 | ControlFlowNode for Attribute | full_partial_test.py:73:18:73:48 | ControlFlowNode for Subscript |
| full_partial_test.py:73:18:73:48 | ControlFlowNode for Subscript | full_partial_test.py:76:18:76:20 | ControlFlowNode for url |
| full_partial_test.py:79:18:79:24 | ControlFlowNode for request | full_partial_test.py:79:18:79:29 | ControlFlowNode for Attribute |
| full_partial_test.py:79:18:79:29 | ControlFlowNode for Attribute | full_partial_test.py:79:18:79:48 | ControlFlowNode for Subscript |
| full_partial_test.py:79:18:79:48 | ControlFlowNode for Subscript | full_partial_test.py:82:18:82:20 | ControlFlowNode for url |
| full_partial_test.py:85:18:85:24 | ControlFlowNode for request | full_partial_test.py:85:18:85:29 | ControlFlowNode for Attribute |
| full_partial_test.py:85:18:85:29 | ControlFlowNode for Attribute | full_partial_test.py:85:18:85:48 | ControlFlowNode for Subscript |
| full_partial_test.py:85:18:85:48 | ControlFlowNode for Subscript | full_partial_test.py:88:18:88:20 | ControlFlowNode for url |
| full_partial_test.py:91:18:91:24 | ControlFlowNode for request | full_partial_test.py:91:18:91:29 | ControlFlowNode for Attribute |
| full_partial_test.py:91:18:91:29 | ControlFlowNode for Attribute | full_partial_test.py:91:18:91:48 | ControlFlowNode for Subscript |
| full_partial_test.py:91:18:91:48 | ControlFlowNode for Subscript | full_partial_test.py:94:18:94:20 | ControlFlowNode for url |
| full_partial_test.py:97:18:97:24 | ControlFlowNode for request | full_partial_test.py:97:18:97:29 | ControlFlowNode for Attribute |
| full_partial_test.py:97:18:97:29 | ControlFlowNode for Attribute | full_partial_test.py:97:18:97:48 | ControlFlowNode for Subscript |
| full_partial_test.py:97:18:97:48 | ControlFlowNode for Subscript | full_partial_test.py:103:18:103:20 | ControlFlowNode for url |
| full_partial_test.py:106:18:106:24 | ControlFlowNode for request | full_partial_test.py:106:18:106:29 | ControlFlowNode for Attribute |
| full_partial_test.py:106:18:106:29 | ControlFlowNode for Attribute | full_partial_test.py:106:18:106:48 | ControlFlowNode for Subscript |
| full_partial_test.py:106:18:106:48 | ControlFlowNode for Subscript | full_partial_test.py:109:18:109:20 | ControlFlowNode for url |
| test_http_client.py:9:19:9:25 | ControlFlowNode for request | test_http_client.py:9:19:9:30 | ControlFlowNode for Attribute |
| test_http_client.py:9:19:9:25 | ControlFlowNode for request | test_http_client.py:9:19:9:30 | ControlFlowNode for Attribute |
| test_http_client.py:9:19:9:25 | ControlFlowNode for request | test_http_client.py:10:19:10:25 | ControlFlowNode for request |
@@ -87,25 +115,58 @@ nodes
| full_partial_test.py:13:18:13:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:19:18:19:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:23:18:23:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:28:18:28:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:31:18:31:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:34:18:34:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:39:18:39:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:42:18:42:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:44:38:44:58 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
| full_partial_test.py:45:18:45:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:50:18:50:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:53:18:53:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:56:18:56:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:60:18:60:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:60:18:60:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:60:18:60:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:30:18:30:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:30:18:30:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:30:18:30:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:31:17:31:23 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:31:17:31:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:31:17:31:41 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:35:18:35:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:38:18:38:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:41:18:41:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:44:18:44:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:44:18:44:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:44:18:44:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:45:17:45:23 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:45:17:45:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:45:17:45:41 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:49:18:49:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:52:18:52:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:54:38:54:58 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
| full_partial_test.py:55:18:55:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:58:18:58:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:58:18:58:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:58:18:58:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:59:17:59:23 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:59:17:59:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:59:17:59:41 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:63:18:63:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:66:18:66:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:69:18:69:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:72:18:72:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:78:18:78:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:81:18:81:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:73:18:73:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:73:18:73:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:73:18:73:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:76:18:76:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:79:18:79:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:79:18:79:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:79:18:79:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:82:18:82:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:85:18:85:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:85:18:85:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:85:18:85:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:88:18:88:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:91:18:91:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:91:18:91:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:91:18:91:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:94:18:94:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:97:18:97:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:97:18:97:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:97:18:97:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:103:18:103:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:106:18:106:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:106:18:106:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:106:18:106:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:109:18:109:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| test_http_client.py:9:19:9:25 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| test_http_client.py:9:19:9:25 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| test_http_client.py:9:19:9:30 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |

171
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/PartialServerSideRequestForgery.expected
View File

@@ -10,30 +10,58 @@ edges
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:13:18:13:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:19:18:19:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:23:18:23:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:28:18:28:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:31:18:31:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:34:18:34:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:39:18:39:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:42:18:42:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:44:38:44:58 | ControlFlowNode for Tuple |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:50:18:50:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:53:18:53:20 | ControlFlowNode for url |
| full_partial_test.py:7:18:7:48 | ControlFlowNode for Subscript | full_partial_test.py:56:18:56:20 | ControlFlowNode for url |
| full_partial_test.py:8:17:8:23 | ControlFlowNode for request | full_partial_test.py:8:17:8:28 | ControlFlowNode for Attribute |
| full_partial_test.py:8:17:8:28 | ControlFlowNode for Attribute | full_partial_test.py:8:17:8:41 | ControlFlowNode for Subscript |
| full_partial_test.py:8:17:8:41 | ControlFlowNode for Subscript | full_partial_test.py:23:18:23:20 | ControlFlowNode for url |
| full_partial_test.py:8:17:8:41 | ControlFlowNode for Subscript | full_partial_test.py:34:18:34:20 | ControlFlowNode for url |
| full_partial_test.py:8:17:8:41 | ControlFlowNode for Subscript | full_partial_test.py:44:38:44:58 | ControlFlowNode for Tuple |
| full_partial_test.py:8:17:8:41 | ControlFlowNode for Subscript | full_partial_test.py:56:18:56:20 | ControlFlowNode for url |
| full_partial_test.py:44:38:44:58 | ControlFlowNode for Tuple | full_partial_test.py:45:18:45:20 | ControlFlowNode for url |
| full_partial_test.py:60:18:60:24 | ControlFlowNode for request | full_partial_test.py:60:18:60:29 | ControlFlowNode for Attribute |
| full_partial_test.py:60:18:60:29 | ControlFlowNode for Attribute | full_partial_test.py:60:18:60:48 | ControlFlowNode for Subscript |
| full_partial_test.py:60:18:60:48 | ControlFlowNode for Subscript | full_partial_test.py:63:18:63:20 | ControlFlowNode for url |
| full_partial_test.py:60:18:60:48 | ControlFlowNode for Subscript | full_partial_test.py:66:18:66:20 | ControlFlowNode for url |
| full_partial_test.py:60:18:60:48 | ControlFlowNode for Subscript | full_partial_test.py:69:18:69:20 | ControlFlowNode for url |
| full_partial_test.py:60:18:60:48 | ControlFlowNode for Subscript | full_partial_test.py:72:18:72:20 | ControlFlowNode for url |
| full_partial_test.py:60:18:60:48 | ControlFlowNode for Subscript | full_partial_test.py:78:18:78:20 | ControlFlowNode for url |
| full_partial_test.py:60:18:60:48 | ControlFlowNode for Subscript | full_partial_test.py:81:18:81:20 | ControlFlowNode for url |
| full_partial_test.py:30:18:30:24 | ControlFlowNode for request | full_partial_test.py:30:18:30:29 | ControlFlowNode for Attribute |
| full_partial_test.py:30:18:30:24 | ControlFlowNode for request | full_partial_test.py:31:17:31:23 | ControlFlowNode for request |
| full_partial_test.py:30:18:30:24 | ControlFlowNode for request | full_partial_test.py:31:17:31:28 | ControlFlowNode for Attribute |
| full_partial_test.py:30:18:30:29 | ControlFlowNode for Attribute | full_partial_test.py:30:18:30:48 | ControlFlowNode for Subscript |
| full_partial_test.py:30:18:30:48 | ControlFlowNode for Subscript | full_partial_test.py:35:18:35:20 | ControlFlowNode for url |
| full_partial_test.py:30:18:30:48 | ControlFlowNode for Subscript | full_partial_test.py:38:18:38:20 | ControlFlowNode for url |
| full_partial_test.py:30:18:30:48 | ControlFlowNode for Subscript | full_partial_test.py:41:18:41:20 | ControlFlowNode for url |
| full_partial_test.py:31:17:31:23 | ControlFlowNode for request | full_partial_test.py:31:17:31:28 | ControlFlowNode for Attribute |
| full_partial_test.py:31:17:31:28 | ControlFlowNode for Attribute | full_partial_test.py:31:17:31:41 | ControlFlowNode for Subscript |
| full_partial_test.py:31:17:31:41 | ControlFlowNode for Subscript | full_partial_test.py:41:18:41:20 | ControlFlowNode for url |
| full_partial_test.py:44:18:44:24 | ControlFlowNode for request | full_partial_test.py:44:18:44:29 | ControlFlowNode for Attribute |
| full_partial_test.py:44:18:44:24 | ControlFlowNode for request | full_partial_test.py:45:17:45:23 | ControlFlowNode for request |
| full_partial_test.py:44:18:44:24 | ControlFlowNode for request | full_partial_test.py:45:17:45:28 | ControlFlowNode for Attribute |
| full_partial_test.py:44:18:44:29 | ControlFlowNode for Attribute | full_partial_test.py:44:18:44:48 | ControlFlowNode for Subscript |
| full_partial_test.py:44:18:44:48 | ControlFlowNode for Subscript | full_partial_test.py:49:18:49:20 | ControlFlowNode for url |
| full_partial_test.py:44:18:44:48 | ControlFlowNode for Subscript | full_partial_test.py:52:18:52:20 | ControlFlowNode for url |
| full_partial_test.py:44:18:44:48 | ControlFlowNode for Subscript | full_partial_test.py:54:38:54:58 | ControlFlowNode for Tuple |
| full_partial_test.py:45:17:45:23 | ControlFlowNode for request | full_partial_test.py:45:17:45:28 | ControlFlowNode for Attribute |
| full_partial_test.py:45:17:45:28 | ControlFlowNode for Attribute | full_partial_test.py:45:17:45:41 | ControlFlowNode for Subscript |
| full_partial_test.py:45:17:45:41 | ControlFlowNode for Subscript | full_partial_test.py:54:38:54:58 | ControlFlowNode for Tuple |
| full_partial_test.py:54:38:54:58 | ControlFlowNode for Tuple | full_partial_test.py:55:18:55:20 | ControlFlowNode for url |
| full_partial_test.py:58:18:58:24 | ControlFlowNode for request | full_partial_test.py:58:18:58:29 | ControlFlowNode for Attribute |
| full_partial_test.py:58:18:58:24 | ControlFlowNode for request | full_partial_test.py:59:17:59:23 | ControlFlowNode for request |
| full_partial_test.py:58:18:58:24 | ControlFlowNode for request | full_partial_test.py:59:17:59:28 | ControlFlowNode for Attribute |
| full_partial_test.py:58:18:58:29 | ControlFlowNode for Attribute | full_partial_test.py:58:18:58:48 | ControlFlowNode for Subscript |
| full_partial_test.py:58:18:58:48 | ControlFlowNode for Subscript | full_partial_test.py:63:18:63:20 | ControlFlowNode for url |
| full_partial_test.py:58:18:58:48 | ControlFlowNode for Subscript | full_partial_test.py:66:18:66:20 | ControlFlowNode for url |
| full_partial_test.py:58:18:58:48 | ControlFlowNode for Subscript | full_partial_test.py:69:18:69:20 | ControlFlowNode for url |
| full_partial_test.py:59:17:59:23 | ControlFlowNode for request | full_partial_test.py:59:17:59:28 | ControlFlowNode for Attribute |
| full_partial_test.py:59:17:59:28 | ControlFlowNode for Attribute | full_partial_test.py:59:17:59:41 | ControlFlowNode for Subscript |
| full_partial_test.py:59:17:59:41 | ControlFlowNode for Subscript | full_partial_test.py:69:18:69:20 | ControlFlowNode for url |
| full_partial_test.py:73:18:73:24 | ControlFlowNode for request | full_partial_test.py:73:18:73:29 | ControlFlowNode for Attribute |
| full_partial_test.py:73:18:73:29 | ControlFlowNode for Attribute | full_partial_test.py:73:18:73:48 | ControlFlowNode for Subscript |
| full_partial_test.py:73:18:73:48 | ControlFlowNode for Subscript | full_partial_test.py:76:18:76:20 | ControlFlowNode for url |
| full_partial_test.py:79:18:79:24 | ControlFlowNode for request | full_partial_test.py:79:18:79:29 | ControlFlowNode for Attribute |
| full_partial_test.py:79:18:79:29 | ControlFlowNode for Attribute | full_partial_test.py:79:18:79:48 | ControlFlowNode for Subscript |
| full_partial_test.py:79:18:79:48 | ControlFlowNode for Subscript | full_partial_test.py:82:18:82:20 | ControlFlowNode for url |
| full_partial_test.py:85:18:85:24 | ControlFlowNode for request | full_partial_test.py:85:18:85:29 | ControlFlowNode for Attribute |
| full_partial_test.py:85:18:85:29 | ControlFlowNode for Attribute | full_partial_test.py:85:18:85:48 | ControlFlowNode for Subscript |
| full_partial_test.py:85:18:85:48 | ControlFlowNode for Subscript | full_partial_test.py:88:18:88:20 | ControlFlowNode for url |
| full_partial_test.py:91:18:91:24 | ControlFlowNode for request | full_partial_test.py:91:18:91:29 | ControlFlowNode for Attribute |
| full_partial_test.py:91:18:91:29 | ControlFlowNode for Attribute | full_partial_test.py:91:18:91:48 | ControlFlowNode for Subscript |
| full_partial_test.py:91:18:91:48 | ControlFlowNode for Subscript | full_partial_test.py:94:18:94:20 | ControlFlowNode for url |
| full_partial_test.py:97:18:97:24 | ControlFlowNode for request | full_partial_test.py:97:18:97:29 | ControlFlowNode for Attribute |
| full_partial_test.py:97:18:97:29 | ControlFlowNode for Attribute | full_partial_test.py:97:18:97:48 | ControlFlowNode for Subscript |
| full_partial_test.py:97:18:97:48 | ControlFlowNode for Subscript | full_partial_test.py:103:18:103:20 | ControlFlowNode for url |
| full_partial_test.py:106:18:106:24 | ControlFlowNode for request | full_partial_test.py:106:18:106:29 | ControlFlowNode for Attribute |
| full_partial_test.py:106:18:106:29 | ControlFlowNode for Attribute | full_partial_test.py:106:18:106:48 | ControlFlowNode for Subscript |
| full_partial_test.py:106:18:106:48 | ControlFlowNode for Subscript | full_partial_test.py:109:18:109:20 | ControlFlowNode for url |
| test_http_client.py:9:19:9:25 | ControlFlowNode for request | test_http_client.py:9:19:9:30 | ControlFlowNode for Attribute |
| test_http_client.py:9:19:9:25 | ControlFlowNode for request | test_http_client.py:9:19:9:30 | ControlFlowNode for Attribute |
| test_http_client.py:9:19:9:25 | ControlFlowNode for request | test_http_client.py:10:19:10:25 | ControlFlowNode for request |
@@ -87,25 +115,58 @@ nodes
| full_partial_test.py:13:18:13:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:19:18:19:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:23:18:23:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:28:18:28:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:31:18:31:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:34:18:34:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:39:18:39:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:42:18:42:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:44:38:44:58 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
| full_partial_test.py:45:18:45:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:50:18:50:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:53:18:53:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:56:18:56:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:60:18:60:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:60:18:60:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:60:18:60:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:30:18:30:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:30:18:30:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:30:18:30:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:31:17:31:23 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:31:17:31:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:31:17:31:41 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:35:18:35:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:38:18:38:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:41:18:41:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:44:18:44:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:44:18:44:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:44:18:44:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:45:17:45:23 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:45:17:45:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:45:17:45:41 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:49:18:49:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:52:18:52:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:54:38:54:58 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
| full_partial_test.py:55:18:55:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:58:18:58:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:58:18:58:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:58:18:58:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:59:17:59:23 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:59:17:59:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:59:17:59:41 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:63:18:63:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:66:18:66:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:69:18:69:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:72:18:72:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:78:18:78:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:81:18:81:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:73:18:73:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:73:18:73:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:73:18:73:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:76:18:76:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:79:18:79:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:79:18:79:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:79:18:79:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:82:18:82:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:85:18:85:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:85:18:85:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:85:18:85:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:88:18:88:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:91:18:91:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:91:18:91:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:91:18:91:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:94:18:94:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:97:18:97:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:97:18:97:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:97:18:97:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:103:18:103:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| full_partial_test.py:106:18:106:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| full_partial_test.py:106:18:106:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| full_partial_test.py:106:18:106:48 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
| full_partial_test.py:109:18:109:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
| test_http_client.py:9:19:9:25 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| test_http_client.py:9:19:9:25 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
| test_http_client.py:9:19:9:30 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
@@ -149,24 +210,24 @@ subpaths
| full_partial_test.py:19:5:19:21 | ControlFlowNode for Attribute() | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | full_partial_test.py:19:18:19:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:23:5:23:21 | ControlFlowNode for Attribute() | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | full_partial_test.py:23:18:23:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:23:5:23:21 | ControlFlowNode for Attribute() | full_partial_test.py:8:17:8:23 | ControlFlowNode for request | full_partial_test.py:23:18:23:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:8:17:8:23 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:28:5:28:21 | ControlFlowNode for Attribute() | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | full_partial_test.py:28:18:28:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:31:5:31:21 | ControlFlowNode for Attribute() | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | full_partial_test.py:31:18:31:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:34:5:34:21 | ControlFlowNode for Attribute() | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | full_partial_test.py:34:18:34:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:34:5:34:21 | ControlFlowNode for Attribute() | full_partial_test.py:8:17:8:23 | ControlFlowNode for request | full_partial_test.py:34:18:34:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:8:17:8:23 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:39:5:39:21 | ControlFlowNode for Attribute() | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | full_partial_test.py:39:18:39:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:42:5:42:21 | ControlFlowNode for Attribute() | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | full_partial_test.py:42:18:42:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:45:5:45:21 | ControlFlowNode for Attribute() | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | full_partial_test.py:45:18:45:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:45:5:45:21 | ControlFlowNode for Attribute() | full_partial_test.py:8:17:8:23 | ControlFlowNode for request | full_partial_test.py:45:18:45:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:8:17:8:23 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:50:5:50:21 | ControlFlowNode for Attribute() | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | full_partial_test.py:50:18:50:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:53:5:53:21 | ControlFlowNode for Attribute() | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | full_partial_test.py:53:18:53:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:56:5:56:21 | ControlFlowNode for Attribute() | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | full_partial_test.py:56:18:56:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:7:18:7:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:56:5:56:21 | ControlFlowNode for Attribute() | full_partial_test.py:8:17:8:23 | ControlFlowNode for request | full_partial_test.py:56:18:56:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:8:17:8:23 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:63:5:63:21 | ControlFlowNode for Attribute() | full_partial_test.py:60:18:60:24 | ControlFlowNode for request | full_partial_test.py:63:18:63:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:60:18:60:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:66:5:66:21 | ControlFlowNode for Attribute() | full_partial_test.py:60:18:60:24 | ControlFlowNode for request | full_partial_test.py:66:18:66:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:60:18:60:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:69:5:69:21 | ControlFlowNode for Attribute() | full_partial_test.py:60:18:60:24 | ControlFlowNode for request | full_partial_test.py:69:18:69:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:60:18:60:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:72:5:72:21 | ControlFlowNode for Attribute() | full_partial_test.py:60:18:60:24 | ControlFlowNode for request | full_partial_test.py:72:18:72:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:60:18:60:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:78:5:78:21 | ControlFlowNode for Attribute() | full_partial_test.py:60:18:60:24 | ControlFlowNode for request | full_partial_test.py:78:18:78:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:60:18:60:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:81:5:81:21 | ControlFlowNode for Attribute() | full_partial_test.py:60:18:60:24 | ControlFlowNode for request | full_partial_test.py:81:18:81:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:60:18:60:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:35:5:35:21 | ControlFlowNode for Attribute() | full_partial_test.py:30:18:30:24 | ControlFlowNode for request | full_partial_test.py:35:18:35:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:30:18:30:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:38:5:38:21 | ControlFlowNode for Attribute() | full_partial_test.py:30:18:30:24 | ControlFlowNode for request | full_partial_test.py:38:18:38:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:30:18:30:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:41:5:41:21 | ControlFlowNode for Attribute() | full_partial_test.py:30:18:30:24 | ControlFlowNode for request | full_partial_test.py:41:18:41:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:30:18:30:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:41:5:41:21 | ControlFlowNode for Attribute() | full_partial_test.py:31:17:31:23 | ControlFlowNode for request | full_partial_test.py:41:18:41:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:31:17:31:23 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:49:5:49:21 | ControlFlowNode for Attribute() | full_partial_test.py:44:18:44:24 | ControlFlowNode for request | full_partial_test.py:49:18:49:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:44:18:44:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:52:5:52:21 | ControlFlowNode for Attribute() | full_partial_test.py:44:18:44:24 | ControlFlowNode for request | full_partial_test.py:52:18:52:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:44:18:44:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:55:5:55:21 | ControlFlowNode for Attribute() | full_partial_test.py:44:18:44:24 | ControlFlowNode for request | full_partial_test.py:55:18:55:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:44:18:44:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:55:5:55:21 | ControlFlowNode for Attribute() | full_partial_test.py:45:17:45:23 | ControlFlowNode for request | full_partial_test.py:55:18:55:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:45:17:45:23 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:63:5:63:21 | ControlFlowNode for Attribute() | full_partial_test.py:58:18:58:24 | ControlFlowNode for request | full_partial_test.py:63:18:63:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:58:18:58:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:66:5:66:21 | ControlFlowNode for Attribute() | full_partial_test.py:58:18:58:24 | ControlFlowNode for request | full_partial_test.py:66:18:66:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:58:18:58:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:69:5:69:21 | ControlFlowNode for Attribute() | full_partial_test.py:58:18:58:24 | ControlFlowNode for request | full_partial_test.py:69:18:69:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:58:18:58:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:69:5:69:21 | ControlFlowNode for Attribute() | full_partial_test.py:59:17:59:23 | ControlFlowNode for request | full_partial_test.py:69:18:69:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:59:17:59:23 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:76:5:76:21 | ControlFlowNode for Attribute() | full_partial_test.py:73:18:73:24 | ControlFlowNode for request | full_partial_test.py:76:18:76:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:73:18:73:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:82:5:82:21 | ControlFlowNode for Attribute() | full_partial_test.py:79:18:79:24 | ControlFlowNode for request | full_partial_test.py:82:18:82:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:79:18:79:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:88:5:88:21 | ControlFlowNode for Attribute() | full_partial_test.py:85:18:85:24 | ControlFlowNode for request | full_partial_test.py:88:18:88:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:85:18:85:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:94:5:94:21 | ControlFlowNode for Attribute() | full_partial_test.py:91:18:91:24 | ControlFlowNode for request | full_partial_test.py:94:18:94:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:91:18:91:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:103:5:103:21 | ControlFlowNode for Attribute() | full_partial_test.py:97:18:97:24 | ControlFlowNode for request | full_partial_test.py:103:18:103:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:97:18:97:24 | ControlFlowNode for request | a user-provided value |
| full_partial_test.py:109:5:109:21 | ControlFlowNode for Attribute() | full_partial_test.py:106:18:106:24 | ControlFlowNode for request | full_partial_test.py:109:18:109:20 | ControlFlowNode for url | Part of the URL of this request depends on $@. | full_partial_test.py:106:18:106:24 | ControlFlowNode for request | a user-provided value |
| test_http_client.py:22:5:22:31 | ControlFlowNode for Attribute() | test_http_client.py:9:19:9:25 | ControlFlowNode for request | test_http_client.py:18:27:18:37 | ControlFlowNode for unsafe_host | Part of the URL of this request depends on $@. | test_http_client.py:9:19:9:25 | ControlFlowNode for request | a user-provided value |
| test_http_client.py:26:5:26:31 | ControlFlowNode for Attribute() | test_http_client.py:9:19:9:25 | ControlFlowNode for request | test_http_client.py:25:27:25:37 | ControlFlowNode for unsafe_host | Part of the URL of this request depends on $@. | test_http_client.py:9:19:9:25 | ControlFlowNode for request | a user-provided value |
| test_http_client.py:29:5:29:36 | ControlFlowNode for Attribute() | test_http_client.py:9:19:9:25 | ControlFlowNode for request | test_http_client.py:29:25:29:35 | ControlFlowNode for unsafe_path | Part of the URL of this request depends on $@. | test_http_client.py:9:19:9:25 | ControlFlowNode for request | a user-provided value |

34
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/full_partial_test.py
View File

@@ -22,6 +22,13 @@ def full_ssrf():
url = "https://" + user_input + "/foo?key=" + query_val
requests.get(url) # NOT OK -- user has full control
# currently it's not possible to sanitize a step, so due to use-use flow, if we sanitize
# a value that is used later on, it will NOT be tainted later on... so we need to make
# separate tests for each of the vairant cases, so show that we handle all of them.
def full_ssrf_format():
user_input = request.args['untrusted_input']
query_val = request.args['query_val']
# using .format
url = "https://{}".format(user_input)
@@ -33,6 +40,9 @@ def full_ssrf():
url = "https://{}/foo?key={}".format(user_input, query_val)
requests.get(url) # NOT OK -- user has full control
def full_ssrf_percent_format():
user_input = request.args['untrusted_input']
query_val = request.args['query_val']
# using %-formatting
url = "https://%s" % user_input
@@ -44,6 +54,9 @@ def full_ssrf():
url = "https://%s/foo/key=%s" % (user_input, query_val)
requests.get(url) # NOT OK -- user has full control
def full_ssrf_f_strings():
user_input = request.args['untrusted_input']
query_val = request.args['query_val']
# using f-strings
url = f"https://{user_input}"
@@ -56,26 +69,41 @@ def full_ssrf():
requests.get(url) # NOT OK -- user has full control
def partial_ssrf():
def partial_ssrf_1():
user_input = request.args['untrusted_input']
url = "https://example.com/foo?" + user_input
requests.get(url) # NOT OK -- user controls query parameters
url = "https://example.com/" + user_input
requests.get(url) # NOT OK -- user controls path
def partial_ssrf_2():
user_input = request.args['untrusted_input']
url = "https://example.com/" + user_input
requests.get(url) # NOT OK -- user controls path
def partial_ssrf_3():
user_input = request.args['untrusted_input']
url = "https://example.com/" + user_input
requests.get(url) # NOT OK -- user controls path
def partial_ssrf_4():
user_input = request.args['untrusted_input']
url = "https://example.com/foo#{}".format(user_input)
requests.get(url) # NOT OK -- user contollred fragment
def partial_ssrf_5():
user_input = request.args['untrusted_input']
# this is probably the least interesting one, since it's only the fragment that is
# controlled
url = "https://example.com/foo#%s" % user_input
requests.get(url) # NOT OK -- user contollred fragment
def partial_ssrf_6():
user_input = request.args['untrusted_input']
url = f"https://example.com/foo#{user_input}"
requests.get(url) # NOT OK -- user only controlled fragment