Files
codeql/python/ql/test/query-tests/Security/CWE-643-XPathInjection/xpathBad.py
Rasmus Lerchedahl Petersen e51ba6f421 python: rename test directory
2022-02-08 11:20:10 +01:00

19 lines
379 B
Python

from lxml import etree
from io import StringIO
from django.urls import path
from django.http import HttpResponse
from django.template import Template, Context, Engine, engines
def a(request):
value = request.GET['xpath']
f = StringIO('<foo><bar></bar></foo>')
tree = etree.parse(f)
r = tree.xpath("/tag[@id='%s']" % value)
urlpatterns = [
path('a', a)
]