File tree Expand file tree Collapse file tree 7 files changed +5
-39
lines changed
python/ql/test/experimental/query-tests/Security/CWE-943 Expand file tree Collapse file tree 7 files changed +5
-39
lines changed Original file line number Diff line number Diff line change @@ -30,7 +30,7 @@ def get_db_find():
30
30
safe_search = sanitize (json_search )
31
31
32
32
retrieved_db = db .get_db ()
33
- data = retrieved_db ["Movie" ].find ({'name' : safe_search })
33
+ return retrieved_db ["Movie" ].find ({'name' : safe_search })
34
34
35
35
# if __name__ == "__main__":
36
36
# app.run(debug=True)
Original file line number Diff line number Diff line change @@ -11,7 +11,7 @@ def home_page():
11
11
unsafe_search = request .args ['search' ]
12
12
json_search = json .loads (unsafe_search )
13
13
14
- data = mongo .db .user .find ({'name' : json_search })
14
+ return mongo .db .user .find ({'name' : json_search })
15
15
16
16
# if __name__ == "__main__":
17
17
# app.run(debug=True)
Original file line number Diff line number Diff line change @@ -13,7 +13,7 @@ def home_page():
13
13
json_search = json .loads (unsafe_search )
14
14
safe_search = sanitize (json_search )
15
15
16
- data = mongo .db .user .find ({'name' : safe_search })
16
+ return mongo .db .user .find ({'name' : safe_search })
17
17
18
18
# if __name__ == "__main__":
19
19
# app.run(debug=True)
Original file line number Diff line number Diff line change @@ -21,22 +21,6 @@ def connect_find():
21
21
db = me .connect ('mydb' )
22
22
return db .movie .find ({'name' : json_search })
23
23
24
- @app .route ("/connection_connect_find" )
25
- def connection_connect_find ():
26
- unsafe_search = request .args ['search' ]
27
- json_search = json .loads (unsafe_search )
28
-
29
- db = connect ('mydb' )
30
- return db .movie .find ({'name' : json_search })
31
-
32
- @app .route ("/get_db_find" )
33
- def get_db_find ():
34
- unsafe_search = request .args ['search' ]
35
- json_search = json .loads (unsafe_search )
36
-
37
- db = me .get_db ()
38
- return db .movie .find ({'name' : json_search })
39
-
40
24
@app .route ("/connection_get_db_find" )
41
25
def connection_get_db_find ():
42
26
unsafe_search = request .args ['search' ]
Original file line number Diff line number Diff line change @@ -23,15 +23,6 @@ def connect_find():
23
23
db = me .connect ('mydb' )
24
24
return db .movie .find ({'name' : json_search })
25
25
26
- @app .route ("/connection_connect_find" )
27
- def connection_connect_find ():
28
- unsafe_search = request .args ['search' ]
29
- json_search = json .loads (unsafe_search )
30
- safe_search = sanitize (json_search )
31
-
32
- db = connect ('mydb' )
33
- return db .movie .find ({'name' : json_search })
34
-
35
26
@app .route ("/subclass_objects" )
36
27
def subclass_objects ():
37
28
unsafe_search = request .args ['search' ]
@@ -40,15 +31,6 @@ def subclass_objects():
40
31
41
32
return Movie .objects (__raw__ = safe_search )
42
33
43
- @app .route ("/get_db_find" )
44
- def get_db_find ():
45
- unsafe_search = request .args ['search' ]
46
- json_search = json .loads (unsafe_search )
47
- safe_search = sanitize (json_search )
48
-
49
- db = me .get_db ()
50
- return db .movie .find ({'name' : safe_search })
51
-
52
34
@app .route ("/connection_get_db_find" )
53
35
def connection_get_db_find ():
54
36
unsafe_search = request .args ['search' ]
Original file line number Diff line number Diff line change @@ -11,7 +11,7 @@ def home_page():
11
11
unsafe_search = request .args ['search' ]
12
12
json_search = json .loads (unsafe_search )
13
13
14
- data = client .db .collection .find_one ({'data' : json_search })
14
+ return client .db .collection .find_one ({'data' : json_search })
15
15
16
16
# if __name__ == "__main__":
17
17
# app.run(debug=True)
Original file line number Diff line number Diff line change @@ -13,7 +13,7 @@ def home_page():
13
13
json_search = json .loads (unsafe_search )
14
14
safe_search = sanitize (json_search )
15
15
16
- data = client .db .collection .find_one ({'data' : safe_search })
16
+ return client .db .collection .find_one ({'data' : safe_search })
17
17
18
18
# if __name__ == "__main__":
19
19
# app.run(debug=True)
You can’t perform that action at this time.
0 commit comments