Add cookie injection query missing proper tests

2026-04-27 17:55:19 +02:00 · 2021-10-28 10:28:45 +02:00
parent 129edd605e
commit cf9e9f9dd4
7 changed files with 111 additions and 5 deletions
--- a/python/ql/test/experimental/query-tests/Security/CWE-614/flask_bad.py
+++ b/python/ql/test/experimental/query-tests/Security/CWE-614/flask_bad.py
@@ -6,7 +6,7 @@ app = Flask(__name__)
@app.route("/false")
 def false():
    resp = make_response()
-    resp.set_cookie("name", value="value", secure=False,
+    resp.set_cookie(request.args["name"], value=request.args["value"], secure=False,
                    httponly=False, samesite='None')
    return resp