hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 05:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add namespace models

Browse Source
This commit is contained in:
Joe Farebrother
2025-11-25 16:56:36 +00:00
parent b0be8184ac
commit 83eadbad60
3 changed files with 103 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
python/ql/test/library-tests/frameworks/socketio/taint_test.py
View File

@@ -11,13 +11,13 @@ def ensure_not_tainted(*args):
sio = socketio.Server()
@sio.event
def connect(sid, environ, auth): # $ requestHandler routedParameter=sid routedParameter=environ routedParameter=auth
def connect(sid, environ, auth): # $ requestHandler routedParameter=environ routedParameter=auth
ensure_not_tainted(sid)
ensure_tainted(environ, # $ tainted
auth) # $ tainted
@sio.event
def event1(sid, data): # $ requestHandler routedParameter=sid routedParameter=data
def event1(sid, data): # $ requestHandler routedParameter=data
ensure_not_tainted(sid)
ensure_tainted(data) # $ tainted
res = sio.call("e1", sid=sid)
@@ -25,15 +25,26 @@ def event1(sid, data): # $ requestHandler routedParameter=sid routedParameter=da
sio.emit("e2", "hi", to=sid, callback=lambda x: ensure_tainted(x)) # $ tainted
sio.send("hi", to=sid, callback=lambda x: ensure_tainted(x)) # $ tainted
class MyNamespace(socketio.Namespace):
def on_event2(self, sid, data): # $ requestHandler routedParameter=data
ensure_not_tainted(self, sid)
ensure_tainted(data)
res = self.call("e1", sid=sid)
ensure_tainted(res) # $ tainted
self.emit("e2", "hi", to=sid, callback=lambda x: ensure_tainted(x)) # $ tainted
self.send("hi", to=sid, callback=lambda x: ensure_tainted(x)) # $ tainted
sio.register_namespace(MyNamespace("/ns"))
asio = socketio.AsyncServer(async_mode='asgi')
@asio.event
async def event2(sid, data): # $ requestHandler routedParameter=sid routedParameter=data
async def event3(sid, data): # $ requestHandler routedParameter=sid routedParameter=data
ensure_not_tainted(sid)
ensure_tainted(data) # $ tainted
res = await asio.call("e2", sid=sid)
res = await asio.call("e1", sid=sid)
ensure_tainted(res) # $ tainted
await asio.emit("e3", "hi", to=sid, callback=lambda x: ensure_tainted(x)) # $ tainted
await asio.emit("e2", "hi", to=sid, callback=lambda x: ensure_tainted(x)) # $ tainted
await asio.send("hi", to=sid, callback=lambda x: ensure_tainted(x)) # $ tainted
if __name__ == "__main__":

10
python/ql/test/library-tests/frameworks/socketio/test.py
View File

@@ -3,23 +3,23 @@ import socketio
sio = socketio.Server()
@sio.on("connect")
def connect(sid, environ, auth): # $ requestHandler routedParameter=sid routedParameter=environ routedParameter=auth
def connect(sid, environ, auth): # $ requestHandler routedParameter=environ routedParameter=auth
print("connect", sid, environ, auth)
@sio.on("event1")
def handle(sid, data): # $ requestHandler routedParameter=sid routedParameter=data
def handle(sid, data): # $ requestHandler routedParameter=data
print("e1", sid, data)
@sio.event
def event2(sid, data): # $ requestHandler routedParameter=sid routedParameter=data
def event2(sid, data): # $ requestHandler routedParameter=data
print("e2", sid, data)
def event3(sid, data): # $ requestHandler routedParameter=sid routedParameter=data
def event3(sid, data): # $ requestHandler routedParameter=data
print("e3", sid, data)
sio.on("event3", handler=event3)
sio.on("event4", lambda sid,data: print("e4", sid, data)) # $ requestHandler routedParameter=sid routedParameter=data
sio.on("event4", lambda sid,data: print("e4", sid, data)) # $ requestHandler routedParameter=data