hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Move query tests to reflect new file layout

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2021-02-16 13:15:01 +01:00
parent 1d6f9bee08
commit 8494fcf45f
114 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
python/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected
View File

@@ -1,8 +0,0 @@
edges
| test.py:33:15:33:36 | exception info | test.py:34:29:34:31 | exception info |
| test.py:33:15:33:36 | exception info | test.py:34:29:34:31 | exception info |
| test.py:34:29:34:31 | exception info | test.py:34:16:34:32 | exception info |
| test.py:34:29:34:31 | exception info | test.py:34:16:34:32 | exception info |
#select
| test.py:16:16:16:37 | Attribute() | test.py:16:16:16:37 | exception info | test.py:16:16:16:37 | exception info | $@ may be exposed to an external user | test.py:16:16:16:37 | Attribute() | Error information |
| test.py:34:16:34:32 | format_error() | test.py:33:15:33:36 | exception info | test.py:34:16:34:32 | exception info | $@ may be exposed to an external user | test.py:33:15:33:36 | Attribute() | Error information |

1
python/ql/test/query-tests/Security/CWE-209/StackTraceExposure.qlref
View File

@@ -1 +0,0 @@
Security/Exposure/StackTraceExposure/StackTraceExposure.ql

1
python/ql/test/query-tests/Security/CWE-209/options
View File

@@ -1 +0,0 @@
semmle-extractor-options: -p ../lib/ --max-import-depth=2

42
python/ql/test/query-tests/Security/CWE-209/test.py
View File

@@ -1,42 +0,0 @@
from flask import Flask, request, make_response
app = Flask(__name__)
import traceback
def do_computation():
raise Exception("Secret info")
# BAD
@app.route('/bad')
def server_bad():
try:
do_computation()
except Exception as e:
return traceback.format_exc()
# GOOD
@app.route('/good')
def server_good():
try:
do_computation()
except Exception as e:
log(traceback.format_exc())
return "An internal error has occurred!"
#BAD
@app.route('/bad/with-flow')
def server_bad_flow():
try:
do_computation()
except Exception as e:
err = traceback.format_exc()
return format_error(err)
def format_error(msg):
return "[ERROR] " + msg
#Unrelated error
@app.route('/maybe_xss')
def maybe_xss():
return make_response(request.args.get('name', ''))