diff --git a/python/ql/test/experimental/query-tests/Security/CWE-079/django_mail.py b/python/ql/test/experimental/query-tests/Security/CWE-079/django_mail.py index e4be8d12872..a051af71d02 100644 --- a/python/ql/test/experimental/query-tests/Security/CWE-079/django_mail.py +++ b/python/ql/test/experimental/query-tests/Security/CWE-079/django_mail.py @@ -13,12 +13,12 @@ def send(): Apparently there's no html_message in send_mass_mail: https://github.com/django/django/blob/ca9872905559026af82000e46cde6f7dedc897b6/django/core/mail/__init__.py#L64 """ - send_mail("Subject", "body", "from@example.com", ["to@example.com"], html_message=request.args("html")) + send_mail("Subject", "plain-text body", "from@example.com", ["to@example.com"], html_message=request.args("html")) @app.route("/internal") def internal(): """ https://github.com/django/django/blob/ca9872905559026af82000e46cde6f7dedc897b6/django/core/mail/__init__.py#L90-L121 """ - mail_admins("Subject", "body", html_message=request.args("html")) - mail_managers("Subject", "body", html_message=request.args("html")) + mail_admins("Subject", "plain-text body", html_message=request.args("html")) + mail_managers("Subject", "plain-text body", html_message=request.args("html")) diff --git a/python/ql/test/experimental/query-tests/Security/CWE-079/flask_mail.py b/python/ql/test/experimental/query-tests/Security/CWE-079/flask_mail.py index a2b19786057..c5de32c6f94 100644 --- a/python/ql/test/experimental/query-tests/Security/CWE-079/flask_mail.py +++ b/python/ql/test/experimental/query-tests/Security/CWE-079/flask_mail.py @@ -12,11 +12,11 @@ def send(): msg = Message(subject="Subject", sender="from@example.com", recipients=["to@example.com"], - body="body", + body="plain-text body", html=request.args["html"]) # The message can contain a body and/or HTML: - msg.body = "body" + msg.body = "plain-text body" msg.html = request.args["html"] mail.send(msg)