Skip to content

Commit 1a9620a

Browse files
committed
Python: Add conditional assignment check for sax parser
1 parent f0131af commit 1a9620a

File tree

1 file changed

+17
-0
lines changed
  • python/ql/test/experimental/library-tests/frameworks/XML

1 file changed

+17
-0
lines changed

python/ql/test/experimental/library-tests/frameworks/XML/xml_sax.py

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,3 +45,20 @@ def func(cond):
4545
parser.setFeature(xml.sax.handler.feature_external_ges, True)
4646
parser.setFeature(xml.sax.handler.feature_external_ges, False)
4747
parser.parse(StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='Quadratic Blowup'
48+
49+
def check_conditional_assignment(cond):
50+
parser = xml.sax.make_parser()
51+
if cond:
52+
parser.setFeature(xml.sax.handler.feature_external_ges, True)
53+
else:
54+
parser.setFeature(xml.sax.handler.feature_external_ges, False)
55+
parser.parse(StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='DTD retrieval' vuln='Quadratic Blowup' vuln='XXE'
56+
57+
def check_conditional_assignment2(cond):
58+
parser = xml.sax.make_parser()
59+
if cond:
60+
flag_value = True
61+
else:
62+
flag_value = False
63+
parser.setFeature(xml.sax.handler.feature_external_ges, flag_value)
64+
parser.parse(StringIO(x)) # $ input=StringIO(..) vuln='Billion Laughs' vuln='DTD retrieval' vuln='Quadratic Blowup' vuln='XXE'

0 commit comments

Comments
 (0)