hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 18:55:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update TimingAttack.qll

Browse Source
This commit is contained in:
Ahmed Farid
2022-08-31 16:07:58 +01:00
committed by GitHub
parent 8153b790ad
commit a42cb20b86
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
python/ql/src/experimental/semmle/python/security/TimingAttack.qll
View File

@@ -186,7 +186,7 @@ abstract class ClientSuppliedSecret extends API::CallNode { }
private class FlaskClientSuppliedSecret extends ClientSuppliedSecret {
FlaskClientSuppliedSecret() {
this = Flask::request().getMember("headers").getMember(["get", "get_all", "getlist"]).getACall() and
this.getParameter(0, ["key", "name"]).toString().toLowerCase() = sensitiveheaders()
this.getParameter(0, "key").asSink().asExpr().(StrConst).getText().toLowerCase() = sensitiveheaders()
}
}
@@ -197,7 +197,7 @@ private class DjangoClientSuppliedSecret extends ClientSuppliedSecret {
.getMember(["headers", "META"])
.getMember("get")
.getACall() and
this.getParameter(0, "key").toString().toLowerCase() = sensitiveheaders()
this.getParameter(0, "key").asSink().asExpr().(StrConst).getText().toLowerCase() = sensitiveheaders()
}
}
@@ -209,7 +209,7 @@ API::Node requesthandler() {
private class TornadoClientSuppliedSecret extends ClientSuppliedSecret {
TornadoClientSuppliedSecret() {
this = requesthandler().getMember(["headers", "META"]).getMember("get").getACall() and
this.getParameter(0, "key").toString().toLowerCase() = sensitiveheaders()
this.getParameter(0, "key").asSink().asExpr().(StrConst).getText().toLowerCase() = sensitiveheaders()
}
}
@@ -222,7 +222,7 @@ private class WerkzeugClientSuppliedSecret extends ClientSuppliedSecret {
WerkzeugClientSuppliedSecret() {
this =
headers().getMember(["headers", "META"]).getMember(["get", "get_all", "getlist"]).getACall() and
this.getParameter(0, ["key", "name"]).toString().toLowerCase() = sensitiveheaders()
this.getParameter(0, "key").asSink().asExpr().(StrConst).getText().toLowerCase() = sensitiveheaders()
}
}