hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 05:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Port xml.dom tests

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2022-03-03 20:39:56 +01:00
parent faebaee141
commit a7134cac2e
2 changed files with 19 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
python/ql/test/experimental/query-tests/Security/CWE-611/xml_dom.py
View File

@@ -1,43 +0,0 @@
from flask import request, Flask
from io import StringIO, BytesIO
import xml.dom.minidom
import xml.dom.pulldom
import xml.sax
app = Flask(__name__)
# Parsing
@app.route("/xml_minidom_parse")
def xml_minidom_parse():
xml_content = request.args['xml_content']
return xml.dom.minidom.parse(StringIO(xml_content)).documentElement.childNodes # OK for XXE/DTD, NOT OK for billion laughs/quadratic
@app.route("/xml_minidom_parseString")
def xml_minidom_parseString():
xml_content = request.args['xml_content']
return xml.dom.minidom.parseString(xml_content).documentElement.childNodes # OK for XXE/DTD, NOT OK for billion laughs/quadratic
@app.route("/xml_pulldom_parse")
def xml_pulldom_parse():
xml_content = request.args['xml_content']
return xml.dom.pulldom.parse(StringIO(xml_content))['START_DOCUMENT'][1].documentElement.childNodes # OK for XXE/DTD, NOT OK for billion laughs/quadratic
@app.route("/xml_pulldom_parseString")
def xml_pulldom_parseString():
xml_content = request.args['xml_content']
return xml.dom.pulldom.parseString(xml_content)['START_DOCUMENT'][1].documentElement.childNodes # OK for XXE/DTD, NOT OK for billion laughs/quadratic
# With parsers
@app.route("/xml_minidom_parse_xml_sax_make_parser")
def xml_minidom_parse_xml_sax_make_parser():
xml_content = request.args['xml_content']
parser = xml.sax.make_parser()
parser.setFeature(xml.sax.handler.feature_external_ges, True)
return xml.dom.minidom.parse(StringIO(xml_content), parser=parser).documentElement.childNodes # NOT OK for XXE/DTD, NOT OK for billion laughs/quadratic