hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 11:16:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix endpoints' naming

Browse Source
This commit is contained in:
jorgectf
2021-11-05 20:12:35 +01:00
parent b3258ce20f
commit cf47e8eb9c
3 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
python/ql/src/experimental/Security/CWE-614/InsecureCookie.py
View File

@@ -1,15 +1,15 @@
from flask import Flask, request, make_response, Response
@app.route("/true")
@app.route("/1")
def true():
resp = make_response()
resp.set_cookie("name", value="value", secure=True)
return resp
@app.route("/flask_make_response")
@app.route("/2")
def flask_make_response():
resp = make_response("hello")
resp.headers['Set-Cookie'] = "name=value; Secure;"
return resp
return resp

8
python/ql/test/experimental/query-tests/Security/CWE-614/flask_bad.py
View File

@@ -3,7 +3,7 @@ from flask import Flask, request, make_response, Response
app = Flask(__name__)
@app.route("/false")
@app.route("/1")
def false():
resp = make_response()
resp.set_cookie("name", value="value", secure=False,
@@ -11,14 +11,14 @@ def false():
return resp
@app.route("/flask_Response")
@app.route("/2")
def flask_Response():
resp = Response()
resp.headers['Set-Cookie'] = "name=value; SameSite=None;"
return resp
@app.route("/false")
@app.route("/3")
def false():
resp = make_response()
resp.set_cookie(request.args["name"], value=request.args["value"], secure=False,
@@ -26,7 +26,7 @@ def false():
return resp
@app.route("/flask_Response")
@app.route("/4")
def flask_Response():
resp = Response()
resp.headers['Set-Cookie'] = f"{request.args['name']}={request.args['value']}; SameSite=None;"

4
python/ql/test/experimental/query-tests/Security/CWE-614/flask_good.py
View File

@@ -3,7 +3,7 @@ from flask import Flask, request, make_response, Response
app = Flask(__name__)
@app.route("/true")
@app.route("/1")
def true():
resp = make_response()
resp.set_cookie("name", value="value", secure=True,
@@ -11,7 +11,7 @@ def true():
return resp
@app.route("/flask_Response")
@app.route("/2")
def flask_Response():
resp = Response()
resp.headers['Set-Cookie'] = "name=value; Secure; HttpOnly; SameSite=Lax;"