hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 13:45:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Add responses to bottle framework support.

Browse Source
This commit is contained in:
Mark Shannon
2019-02-04 14:35:30 +00:00
parent 8d525e5295
commit d514fc543d
7 changed files with 103 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
python/ql/test/library-tests/web/bottle/Sinks.expected Normal file
View File

@@ -0,0 +1,3 @@
| test.py:9 | BinaryExpr | externally controlled string |
| test.py:13 | BinaryExpr | externally controlled string |
| test.py:19 | BinaryExpr | externally controlled string |

10
python/ql/test/library-tests/web/bottle/Sinks.ql Normal file
View File

@@ -0,0 +1,10 @@
import python
import semmle.python.web.HttpRequest
import semmle.python.web.HttpResponse
import semmle.python.security.strings.Untrusted
from TaintSink sink, TaintKind kind
where sink.sinks(kind)
select sink.getLocation().toString(), sink.(ControlFlowNode).getNode().toString(), kind

15
python/ql/test/library-tests/web/bottle/Taint.expected Normal file
View File

@@ -0,0 +1,15 @@
| ../../../query-tests/Security/lib/bottle.py:64 | LocalRequest() | bottle.request |
| ../../../query-tests/Security/lib/bottle.py:64 | request | bottle.request |
| test.py:3 | ImportMember | bottle.request |
| test.py:3 | request | bottle.request |
| test.py:8 | name | externally controlled string |
| test.py:9 | BinaryExpr | externally controlled string |
| test.py:9 | name | externally controlled string |
| test.py:12 | name | externally controlled string |
| test.py:13 | BinaryExpr | externally controlled string |
| test.py:13 | name | externally controlled string |
| test.py:18 | Attribute | bottle.FormsDict |
| test.py:18 | Attribute | externally controlled string |
| test.py:18 | request | bottle.request |
| test.py:19 | BinaryExpr | externally controlled string |
| test.py:19 | name | externally controlled string |

13
python/ql/test/library-tests/web/bottle/Taint.ql Normal file
View File

@@ -0,0 +1,13 @@
import python
import semmle.python.web.HttpRequest
import semmle.python.web.HttpResponse
import semmle.python.security.strings.Untrusted
from TaintedNode node
select node.getLocation().toString(), node.getNode().getNode().toString(), node.getTaintKind()