Files
codeql/python/ql/test/query-tests/Security/CWE-079/reflected_xss.py
Rasmus Wriedt Larsen 8476bc7d42 Python: correctly handle flask.make_response
Fixes https://github.com/Semmle/ql/issues/1572

Adjust mock so it's more aligned with what the flask code actually does. Tests
were passing before, even though we didn't handle the case in real code :\
2019-11-11 17:24:36 +01:00

14 lines
359 B
Python

from flask import Flask, request, make_response, escape
app = Flask(__name__)
@app.route('/unsafe')
def unsafe():
first_name = request.args.get('name', '')
return make_response("Your name is " + first_name)
@app.route('/safe')
def safe():
first_name = request.args.get('name', '')
return make_response("Your name is " + escape(first_name))