hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 04:39:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: In flask, taint routed prameters for variable rules

Browse Source 
Fixes https://github.com/github/codeql-python-team/issues/79
This commit is contained in:
Rasmus Wriedt Larsen
2020-05-12 14:56:25 +02:00
parent 7d5e35a7aa
commit 8150c78ae0
3 changed files with 48 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
python/ql/test/library-tests/web/flask/HttpSources.expected
View File

@@ -3,3 +3,7 @@
| test.py:35:16:35:27 | Attribute | {externally controlled string} |
| test.py:40:18:40:29 | Attribute | {externally controlled string} |
| test.py:45:18:45:29 | Attribute | {externally controlled string} |
| test.py:49:11:49:14 | name | externally controlled string |
| test.py:53:9:53:15 | subpath | externally controlled string |
| test.py:59:24:59:26 | bar | externally controlled string |
| test.py:63:13:63:21 | lang_code | externally controlled string |

12
python/ql/test/library-tests/web/flask/Taint.expected
View File

@@ -15,7 +15,19 @@
| test.py:45 | Attribute() | externally controlled string |
| test.py:46 | first_name | externally controlled string |
| test.py:46 | make_response() | flask.Response |
| test.py:49 | name | externally controlled string |
| test.py:50 | BinaryExpr | externally controlled string |
| test.py:50 | make_response() | flask.Response |
| test.py:50 | name | externally controlled string |
| test.py:53 | subpath | externally controlled string |
| test.py:54 | BinaryExpr | externally controlled string |
| test.py:54 | make_response() | flask.Response |
| test.py:54 | subpath | externally controlled string |
| test.py:59 | bar | externally controlled string |
| test.py:60 | Attribute() | externally controlled string |
| test.py:60 | bar | externally controlled string |
| test.py:60 | make_response() | flask.Response |
| test.py:63 | lang_code | externally controlled string |
| test.py:64 | Attribute() | externally controlled string |
| test.py:64 | lang_code | externally controlled string |
| test.py:64 | make_response() | flask.Response |