hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 11:46:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Specify plain-text body

Browse Source
This commit is contained in:
jorgectf
2021-06-29 17:28:20 +02:00
parent e0013fcdbb
commit b5ee7c3032
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
python/ql/test/experimental/query-tests/Security/CWE-079/django_mail.py
View File

@@ -13,12 +13,12 @@ def send():
Apparently there's no html_message in send_mass_mail: https://github.com/django/django/blob/ca9872905559026af82000e46cde6f7dedc897b6/django/core/mail/__init__.py#L64
"""
send_mail("Subject", "body", "from@example.com", ["to@example.com"], html_message=request.args("html"))
send_mail("Subject", "plain-text body", "from@example.com", ["to@example.com"], html_message=request.args("html"))
@app.route("/internal")
def internal():
"""
https://github.com/django/django/blob/ca9872905559026af82000e46cde6f7dedc897b6/django/core/mail/__init__.py#L90-L121
"""
mail_admins("Subject", "body", html_message=request.args("html"))
mail_managers("Subject", "body", html_message=request.args("html"))
mail_admins("Subject", "plain-text body", html_message=request.args("html"))
mail_managers("Subject", "plain-text body", html_message=request.args("html"))

4
python/ql/test/experimental/query-tests/Security/CWE-079/flask_mail.py
View File

@@ -12,11 +12,11 @@ def send():
msg = Message(subject="Subject",
sender="from@example.com",
recipients=["to@example.com"],
body="body",
body="plain-text body",
html=request.args["html"])
# The message can contain a body and/or HTML:
msg.body = "body"
msg.body = "plain-text body"
msg.html = request.args["html"]
mail.send(msg)