hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 05:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

add jsonpickle and pexpect libs in case of unsafe decoding and secondary command execution, add proper test cases

Browse Source
This commit is contained in:
amammad
2024-02-25 17:15:35 +04:00
parent 3e6b4a161b
commit ab219902a9
13 changed files with 169 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
python/ql/test/library-tests/frameworks/jsonpickle/ConceptsTest.expected Normal file
View File

@@ -0,0 +1,2 @@
testFailures
failures

2
python/ql/test/library-tests/frameworks/jsonpickle/ConceptsTest.ql Normal file
View File

@@ -0,0 +1,2 @@
import python
import experimental.meta.ConceptsTest

15
python/ql/test/library-tests/frameworks/jsonpickle/Decode.py Normal file
View File

@@ -0,0 +1,15 @@
import os
import jsonpickle
class Thing(object):
def __reduce__(self):
return os.system, ("curl 127.0.0.1:1234",)
obj = Thing()
pickledObj = jsonpickle.encode(obj)
objUnPickled = jsonpickle.decode(pickledObj, safe=True) # $ decodeInput=pickledObj decodeOutput=jsonpickle.decode(..) decodeFormat=pickle decodeMayExecuteInput
print(objUnPickled.name)