mirror of
https://github.com/github/codeql.git
synced 2025-12-18 09:43:15 +01:00
56 lines
1.6 KiB
Python
56 lines
1.6 KiB
Python
import requests
|
|
|
|
from flask import Flask, request
|
|
|
|
app = Flask(__name__)
|
|
|
|
|
|
@app.route("/taint_test") # $ routeSetup="/taint_test"
|
|
def test_taint(): # $ requestHandler
|
|
url = request.args['untrusted_input']
|
|
|
|
# response from a request to a user-controlled URL should be considered
|
|
# user-controlled as well.
|
|
resp = requests.get(url) # $ clientRequestUrlPart=url
|
|
|
|
requests.Response
|
|
requests.models.Response
|
|
|
|
ensure_tainted(
|
|
url, # $ tainted
|
|
# see https://docs.python-requests.org/en/latest/api/#requests.Response
|
|
resp, # $ tainted
|
|
resp.text, # $ tainted
|
|
resp.content, # $ tainted
|
|
resp.json(), # $ tainted
|
|
|
|
# file-like
|
|
resp.raw, # $ tainted
|
|
resp.raw.read(), # $ tainted
|
|
|
|
resp.links, # $ tainted
|
|
resp.links['key'], # $ tainted
|
|
resp.links.get('key'), # $ tainted
|
|
|
|
resp.cookies, # $ tainted
|
|
resp.cookies['key'], # $ tainted
|
|
resp.cookies.get('key'), # $ tainted
|
|
|
|
resp.headers, # $ tainted
|
|
resp.headers['key'], # $ tainted
|
|
resp.headers.get('key'), # $ tainted
|
|
)
|
|
|
|
for content_chunk in resp.iter_content():
|
|
ensure_tainted(content_chunk) # $ tainted
|
|
|
|
for line in resp.iter_lines():
|
|
ensure_tainted(line) # $ tainted
|
|
|
|
# for now, we don't assume that the response to ANY outgoing request is a remote
|
|
# flow source, since this could lead to FPs.
|
|
# TODO: investigate whether we should consider this a remote flow source.
|
|
trusted_url = "https://internal-api-that-i-trust.com"
|
|
resp = requests.get(trusted_url) # $ clientRequestUrlPart=trusted_url
|
|
ensure__not_tainted(resp)
|