hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 04:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: django.http.response.HttpRequest.write

Browse Source
This commit is contained in:
Rasmus Lerchedahl Petersen
2020-10-30 12:51:23 +01:00
parent ffe10d1b7c
commit e69349791a
3 changed files with 41 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
python/ql/test/experimental/library-tests/frameworks/django-v1/response_test.py
View File

@@ -30,12 +30,12 @@ def xss__manual_response_type(request):
def xss__write(request):
response = HttpResponse() # $HttpResponse $mimetype=text/html; charset=utf-8
response.write(request.GET.get("name")) # $f-:HttpResponse $f-:mimetype=text/html; charset=utf-8 $f-:responseBody=Attribute()
response.write(request.GET.get("name")) # $HttpResponse $mimetype=text/html; charset=utf-8 $responseBody=Attribute()
# This is safe but probably a bug if the argument to `write` is not a result of `json.dumps` or similar.
def safe__write_json(request):
response = JsonResponse() # $HttpResponse $mimetype=application/json
response.write(request.GET.get("name")) # $f-:HttpResponse $f-:mimetype=application/json $f-:responseBody=Attribute()
response.write(request.GET.get("name")) # $HttpResponse $mimetype=application/json $responseBody=Attribute()
# Ensure manual subclasses are vulnerable
class CustomResponse(HttpResponse):

2
python/ql/test/experimental/library-tests/frameworks/django-v1/routing_test.py
View File

@@ -18,7 +18,7 @@ def post_params_xss(request): # $routeHandler
def http_resp_write(request): # $routeHandler
rsp = HttpResponse() # $HttpResponse
rsp.write(request.GET.get("untrusted"))
rsp.write(request.GET.get("untrusted")) # $HttpResponse
return rsp