mirror of
https://github.com/github/codeql.git
synced 2026-04-30 11:15:13 +02:00
Python: Add django.shortcuts.redirect test
This commit is contained in:
@@ -1,4 +1,5 @@
|
||||
from django.http.response import HttpResponse, HttpResponseRedirect, HttpResponsePermanentRedirect, JsonResponse, HttpResponseNotFound
|
||||
import django.shortcuts
|
||||
|
||||
# Not an XSS sink, since the Content-Type is not "text/html"
|
||||
# FP reported in https://github.com/github/codeql-python-team/issues/38
|
||||
@@ -48,6 +49,11 @@ def redirect_through_normal_response(request):
|
||||
return resp
|
||||
|
||||
|
||||
def redirect_shortcut(request):
|
||||
next = request.GET.get("next")
|
||||
return django.shortcuts.redirect(next) # $ MISSING: HttpResponse HttpRedirectResponse redirectLocation=next
|
||||
|
||||
|
||||
# Ensure that simple subclasses are still vuln to XSS
|
||||
def xss__not_found(request):
|
||||
return HttpResponseNotFound(request.GET.get("name")) # $HttpResponse mimetype=text/html responseBody=Attribute()
|
||||
|
||||
Reference in New Issue
Block a user