mirror of
https://github.com/github/codeql.git
synced 2025-12-17 17:23:36 +01:00
9cb83fcdc9
copy, pop, get, getitem, setdefault
Also add read steps to taint tracking.
Reading from a tainted collection can be done in two situations:
1. There is an acces path
In this case a read step (possibly from a flow summary)
gives rise to a taint step.
2. There is no access path
In this case an explicit taint step (possibly via a flow
summary) should exist.
22 lines
750 B
Python
22 lines
750 B
Python
from flask import Flask, request, send_from_directory
|
|
app = Flask(__name__)
|
|
|
|
|
|
STATIC_DIR = "/server/static/"
|
|
|
|
|
|
# see https://flask.palletsprojects.com/en/1.1.x/api/#flask.send_from_directory
|
|
@app.route("/provide-filename")
|
|
def download_file():
|
|
filename = request.args.get('filename', '')
|
|
# ok since `send_from_directory` ensure this stays within `STATIC_DIR`
|
|
return send_from_directory(STATIC_DIR, filename) # $result=OK
|
|
|
|
|
|
# see https://flask.palletsprojects.com/en/1.1.x/api/#flask.send_from_directory
|
|
@app.route("/also-provide-dirname")
|
|
def download_file():
|
|
dirname = request.args.get('dirname', '')
|
|
filename = request.args.get('filename', '')
|
|
return send_from_directory(dirname, filename) # $result=BAD result=OK(filename)
|