diff --git a/python/ql/src/experimental/Security/CWE-614/InsecureCookie.py b/python/ql/src/experimental/Security/CWE-614/InsecureCookie.py index 54bbeff7d12..4087830f7eb 100644 --- a/python/ql/src/experimental/Security/CWE-614/InsecureCookie.py +++ b/python/ql/src/experimental/Security/CWE-614/InsecureCookie.py @@ -1,15 +1,15 @@ from flask import Flask, request, make_response, Response -@app.route("/true") +@app.route("/1") def true(): resp = make_response() resp.set_cookie("name", value="value", secure=True) return resp -@app.route("/flask_make_response") +@app.route("/2") def flask_make_response(): resp = make_response("hello") resp.headers['Set-Cookie'] = "name=value; Secure;" - return resp \ No newline at end of file + return resp diff --git a/python/ql/test/experimental/query-tests/Security/CWE-614/flask_bad.py b/python/ql/test/experimental/query-tests/Security/CWE-614/flask_bad.py index 740070a7b53..431df5eb4d8 100644 --- a/python/ql/test/experimental/query-tests/Security/CWE-614/flask_bad.py +++ b/python/ql/test/experimental/query-tests/Security/CWE-614/flask_bad.py @@ -3,7 +3,7 @@ from flask import Flask, request, make_response, Response app = Flask(__name__) -@app.route("/false") +@app.route("/1") def false(): resp = make_response() resp.set_cookie("name", value="value", secure=False, @@ -11,14 +11,14 @@ def false(): return resp -@app.route("/flask_Response") +@app.route("/2") def flask_Response(): resp = Response() resp.headers['Set-Cookie'] = "name=value; SameSite=None;" return resp -@app.route("/false") +@app.route("/3") def false(): resp = make_response() resp.set_cookie(request.args["name"], value=request.args["value"], secure=False, @@ -26,7 +26,7 @@ def false(): return resp -@app.route("/flask_Response") +@app.route("/4") def flask_Response(): resp = Response() resp.headers['Set-Cookie'] = f"{request.args['name']}={request.args['value']}; SameSite=None;" diff --git a/python/ql/test/experimental/query-tests/Security/CWE-614/flask_good.py b/python/ql/test/experimental/query-tests/Security/CWE-614/flask_good.py index 724f8de8289..4cb23bd84b3 100644 --- a/python/ql/test/experimental/query-tests/Security/CWE-614/flask_good.py +++ b/python/ql/test/experimental/query-tests/Security/CWE-614/flask_good.py @@ -3,7 +3,7 @@ from flask import Flask, request, make_response, Response app = Flask(__name__) -@app.route("/true") +@app.route("/1") def true(): resp = make_response() resp.set_cookie("name", value="value", secure=True, @@ -11,7 +11,7 @@ def true(): return resp -@app.route("/flask_Response") +@app.route("/2") def flask_Response(): resp = Response() resp.headers['Set-Cookie'] = "name=value; Secure; HttpOnly; SameSite=Lax;"