hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 20:25:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Some reformatting

Browse Source
This commit is contained in:
Sim4n6
2023-01-26 18:54:36 +01:00
parent 1a211485a4
commit 998f1bf215
2 changed files with 40 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
python/ql/test/experimental/query-tests/Security/CWE-022/UnsafeUnpack.py
View File

@@ -8,16 +8,15 @@ app = Flask(__name__)
# Consider any RemoteFlowSource as a source
@app.route("/download_from_url")
def download_from_url():
filename = request.args.get('filename', '')
if not filename:
response = requests.get(filename, stream=True)
tarpath = "/tmp/tmp456/tarball.tar.gz"
with open(tarpath, "wb") as f:
f.write(response.raw.read())
filename = request.args.get('filename', '')
if not filename:
response = requests.get(filename, stream=True)
untarredpath = "/tmp/tmp123"
shutil.unpack_archive(tarpath, untarredpath) # $result=BAD
tarpath = "/tmp/tmp456/tarball.tar.gz"
with open(tarpath, "wb") as f:
f.write(response.raw.read())
untarredpath = "/tmp/tmp123"
shutil.unpack_archive(tarpath, untarredpath) # $result=BAD
# A source catching an S3 filename download