hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Applying copilot PR suggestions.

Browse Source
This commit is contained in:
REDMOND\brodes
2026-02-10 11:37:11 -05:00
parent 9f8ed710e2
commit a91cf6b7cb
8 changed files with 244 additions and 247 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_requests.py
View File

@@ -1,4 +1,4 @@
from flask import request # $ Source
from flask import request # $ Source[py/full-ssrf]
from AntiSSRF import AntiSSRFPolicy
import requests
@@ -36,7 +36,8 @@ def ssrf_test_with_policy2():
# this makes the session unsafe again
session.mount("http://", requests.adapters.HTTPAdapter())
# NOT OK -- dangerous user input is no longer filtered by AntiSSRFPolicy
response = session.get(user_input) # $ Alert[py/full-ssrf]
# TODO: not currently a scenario we detect.
session.get(user_input) # $ MISSING: Alert[py/full-ssrf]
def ssrf_test_with_policy3(adapter):
user_input = request.args['untrusted_input']
@@ -46,4 +47,5 @@ def ssrf_test_with_policy3(adapter):
# this could make the session unsafe again
session.mount("http://", adapter)
# NOT OK -- dangerous user input is no longer filtered by AntiSSRFPolicy
response = session.get(user_input) # $ Alert[py/full-ssrf]
# TODO: not currently a scenario we detect.
session.get(user_input) # $ MISSING: Alert[py/full-ssrf]