hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Change fastapi raw cookie header models to header write models

Browse Source
This commit is contained in:
Joe Farebrother
2024-06-21 09:09:14 +01:00
parent a0201e9c4f
commit 7704801e47
3 changed files with 15 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
python/ql/lib/semmle/python/Concepts.qll
View File

@@ -1239,7 +1239,7 @@ module Http {
{ {
CookieHeaderWrite() { CookieHeaderWrite() {
exists(StringLiteral str | exists(StringLiteral str |
str.getText() = "Set-Cookie" and str.getText().toLowerCase() = "set-cookie" and
DataFlow::exprNode(str) DataFlow::exprNode(str)
.(DataFlow::LocalSourceNode) .(DataFlow::LocalSourceNode)
.flowsTo(this.(Http::Server::ResponseHeaderWrite).getNameArg()) .flowsTo(this.(Http::Server::ResponseHeaderWrite).getNameArg())

21
python/ql/lib/semmle/python/frameworks/FastApi.qll
View File

@@ -361,28 +361,27 @@ module FastApi {
} }
/** /**
* A call to `append` on a `headers` of a FastAPI Response, with the `Set-Cookie` * A call to `append` on a `headers` of a FastAPI Response.
* header-key.
*/ */
private class HeadersAppendCookie extends Http::Server::CookieWrite::Range, private class HeadersAppend extends Http::Server::ResponseHeaderWrite::Range,
DataFlow::MethodCallNode DataFlow::MethodCallNode
{ {
HeadersAppendCookie() { HeadersAppend() {
exists(DataFlow::AttrRead headers, DataFlow::Node keyArg | exists(DataFlow::AttrRead headers |
headers.accesses(instance(), "headers") and headers.accesses(instance(), "headers") and
this.calls(headers, "append") and this.calls(headers, "append")
keyArg in [this.getArg(0), this.getArgByName("key")] and
keyArg.getALocalSource().asExpr().(StringLiteral).getText().toLowerCase() = "set-cookie"
) )
} }
override DataFlow::Node getHeaderArg() { override DataFlow::Node getNameArg() { result = [this.getArg(0), this.getArgByName("key")] }
override DataFlow::Node getValueArg() {
result in [this.getArg(1), this.getArgByName("value")] result in [this.getArg(1), this.getArgByName("value")]
} }
override DataFlow::Node getNameArg() { none() } override predicate nameAllowsNewline() { none() }
override DataFlow::Node getValueArg() { none() } override predicate valueAllowsNewline() { none() }
} }
} }
} }

8
python/ql/test/library-tests/frameworks/fastapi/response_test.py
View File

@@ -11,9 +11,9 @@ app = FastAPI()
async def response_parameter(response: Response): # $ requestHandler async def response_parameter(response: Response): # $ requestHandler
response.set_cookie("key", "value") # $ CookieWrite CookieName="key" CookieValue="value" response.set_cookie("key", "value") # $ CookieWrite CookieName="key" CookieValue="value"
response.set_cookie(key="key", value="value") # $ CookieWrite CookieName="key" CookieValue="value" response.set_cookie(key="key", value="value") # $ CookieWrite CookieName="key" CookieValue="value"
response.headers.append("Set-Cookie", "key2=value2") # $ CookieWrite CookieRawHeader="key2=value2" response.headers.append("Set-Cookie", "key2=value2") # $ headerWriteName="Set-Cookie" headerWriteValue="key2=value2" CookieWrite CookieRawHeader="key2=value2"
response.headers.append(key="Set-Cookie", value="key2=value2") # $ CookieWrite CookieRawHeader="key2=value2" response.headers.append(key="Set-Cookie", value="key2=value2") # $ headerWriteName="Set-Cookie" headerWriteValue="key2=value2" CookieWrite CookieRawHeader="key2=value2"
response.headers["X-MyHeader"] = "header-value" response.headers["X-MyHeader"] = "header-value" # $ MISSING: headerWriteName="X-MyHeader" headerWriteValue="header-value"
response.status_code = 418 response.status_code = 418
return {"message": "response as parameter"} # $ HttpResponse mimetype=application/json responseBody=Dict return {"message": "response as parameter"} # $ HttpResponse mimetype=application/json responseBody=Dict
@@ -45,7 +45,7 @@ async def response_parameter_custom_type(response: MyXmlResponse): # $ requestHa
print(type(response)) print(type(response))
assert type(response) == fastapi.responses.Response assert type(response) == fastapi.responses.Response
response.set_cookie("key", "value") # $ CookieWrite CookieName="key" CookieValue="value" response.set_cookie("key", "value") # $ CookieWrite CookieName="key" CookieValue="value"
response.headers["Custom-Response-Type"] = "yes, but only after function has run" response.headers["Custom-Response-Type"] = "yes, but only after function has run" # $ MISSING: headerWriteName="Custom-Response-Typer" headerWriteValue="yes, but only after function has run"
xml_data = "<foo>FOO</foo>" xml_data = "<foo>FOO</foo>"
return xml_data # $ HttpResponse responseBody=xml_data mimetype=application/xml return xml_data # $ HttpResponse responseBody=xml_data mimetype=application/xml