hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Specify plain-text body

Browse Source
This commit is contained in:
jorgectf
2021-06-29 17:28:20 +02:00
parent e0013fcdbb
commit b5ee7c3032
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
python/ql/test/experimental/query-tests/Security/CWE-079/django_mail.py
View File

@@ -13,12 +13,12 @@ def send():
Apparently there's no html_message in send_mass_mail: https://github.com/django/django/blob/ca9872905559026af82000e46cde6f7dedc897b6/django/core/mail/__init__.py#L64 Apparently there's no html_message in send_mass_mail: https://github.com/django/django/blob/ca9872905559026af82000e46cde6f7dedc897b6/django/core/mail/__init__.py#L64
""" """
send_mail("Subject", "body", "from@example.com", ["to@example.com"], html_message=request.args("html")) send_mail("Subject", "plain-text body", "from@example.com", ["to@example.com"], html_message=request.args("html"))
@app.route("/internal") @app.route("/internal")
def internal(): def internal():
""" """
https://github.com/django/django/blob/ca9872905559026af82000e46cde6f7dedc897b6/django/core/mail/__init__.py#L90-L121 https://github.com/django/django/blob/ca9872905559026af82000e46cde6f7dedc897b6/django/core/mail/__init__.py#L90-L121
""" """
mail_admins("Subject", "body", html_message=request.args("html")) mail_admins("Subject", "plain-text body", html_message=request.args("html"))
mail_managers("Subject", "body", html_message=request.args("html")) mail_managers("Subject", "plain-text body", html_message=request.args("html"))

4
python/ql/test/experimental/query-tests/Security/CWE-079/flask_mail.py
View File

@@ -12,11 +12,11 @@ def send():
msg = Message(subject="Subject", msg = Message(subject="Subject",
sender="from@example.com", sender="from@example.com",
recipients=["to@example.com"], recipients=["to@example.com"],
body="body", body="plain-text body",
html=request.args["html"]) html=request.args["html"])
# The message can contain a body and/or HTML: # The message can contain a body and/or HTML:
msg.body = "body" msg.body = "plain-text body"
msg.html = request.args["html"] msg.html = request.args["html"]
mail.send(msg) mail.send(msg)