Skip to content

Commit 1d4d8ab

Browse files
jorgectfjorgectf
committed
Fix tests
1 parent b942251 commit 1d4d8ab

File tree

8 files changed

+76
-81
lines changed

8 files changed

+76
-81
lines changed

‎python/ql/src/experimental/Security/CWE-287/examples/auth_bad_2.py

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
from flask import request, Flask
22
import ldap
3+
import ldap.filter
4+
import ldap.dn
35

46

57
@app.route("/bind_example")
68
def bind_example():
7-
dn = request.args['dc']
8-
search_filter = request.args['search']
9+
dn = "dc={}".format(ldap.dn.escape_dn_chars(request.args['dc']))
10+
search_filter = "(user={})".format(ldap.filter.escape_filter_chars(request.args['search']))
911

1012
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
1113
ldap_connection.bind('cn=root', "")

‎python/ql/src/experimental/Security/CWE-287/examples/auth_bad_3.py

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
from ldap3 import Server, Connection, ALL
22
from flask import request, Flask
3-
3+
from ldap3.utils.dn import escape_rdn
4+
from ldap3.utils.conv import escape_filter_chars
45

56
@app.route("/passwordNone")
67
def passwordNone():
7-
dn = request.args['dc']
8-
search_filter = request.args['search']
8+
dn = "dc={}".format(escape_rdn(request.args['dc']))
9+
search_filter = "(user={})".format(escape_filter_chars(request.args['search']))
910

1011
srv = Server('servername', get_info=ALL)
1112
conn = Connection(srv, user='user_dn', password=None)

‎python/ql/src/experimental/Security/CWE-287/examples/auth_good_2.py

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
from flask import request, Flask
22
import ldap
3-
import os
3+
import ldap.filter
4+
import ldap.dn
45

56

67
@app.route("/bind_example")
78
def bind_example():
8-
dn = request.args['dc']
9-
search_filter = request.args['search']
9+
dn = "dc={}".format(ldap.dn.escape_dn_chars(request.args['dc']))
10+
search_filter = "(user={})".format(ldap.filter.escape_filter_chars(request.args['search']))
1011

1112
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
12-
ldap_connection.bind('cn=root', os.environ.get('LDAP_PASSWORD'))
13+
ldap_connection.bind('cn=root', "SecurePa$$!")
1314
user = ldap_connection.search_s(dn, ldap.SCOPE_SUBTREE, search_filter)

‎python/ql/src/experimental/Security/CWE-287/examples/auth_good_3.py

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
from ldap3 import Server, Connection, ALL
22
from flask import request, Flask
3-
import os
4-
3+
from ldap3.utils.dn import escape_rdn
4+
from ldap3.utils.conv import escape_filter_chars
55

66
@app.route("/passwordFromEnv")
77
def passwordFromEnv():
8-
dn = request.args['dc']
9-
search_filter = request.args['search']
8+
dn = "dc={}".format(escape_rdn(request.args['dc']))
9+
search_filter = "(user={})".format(escape_filter_chars(request.args['search']))
1010

1111
srv = Server('servername', get_info=ALL)
1212
conn = Connection(srv, user='user_dn',
13-
password=os.environ.get('LDAP_PASSWORD'))
13+
password="SecurePa$$!")
1414
status, result, response, _ = conn.search(dn, search_filter)

‎python/ql/test/experimental/query-tests/Security/CWE-287/auth_bad_2.py

Lines changed: 20 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,19 @@
11
from flask import request, Flask
22
import ldap
3+
import ldap.filter
4+
import ldap.dn
35

46
app = Flask(__name__)
57

68

79
@app.route("/simple_bind_example")
810
def simple_bind_example():
911
"""
10-
A RemoteFlowSource is used directly as DN and search filter while the bind's password
11-
is not set
12+
The bind's password argument is not set
1213
"""
1314

14-
dn = request.args['dc']
15-
search_filter = request.args['search']
15+
dn = "dc={}".format(ldap.dn.escape_dn_chars(request.args['dc']))
16+
search_filter = "(user={})".format(ldap.filter.escape_filter_chars(request.args['search']))
1617

1718
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
1819
ldap_connection.simple_bind('cn=root')
@@ -22,12 +23,11 @@ def simple_bind_example():
2223
@app.route("/simple_bind_s_example")
2324
def simple_bind_s_example():
2425
"""
25-
A RemoteFlowSource is used directly as DN and search filter while the bind's password
26-
is not set
26+
The bind's password argument is not set
2727
"""
2828

29-
dn = request.args['dc']
30-
search_filter = request.args['search']
29+
dn = "dc={}".format(ldap.dn.escape_dn_chars(request.args['dc']))
30+
search_filter = "(user={})".format(ldap.filter.escape_filter_chars(request.args['search']))
3131

3232
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
3333
ldap_connection.simple_bind_s('cn=root')
@@ -37,12 +37,11 @@ def simple_bind_s_example():
3737
@app.route("/bind_s_example")
3838
def bind_s_example():
3939
"""
40-
A RemoteFlowSource is used directly as DN and search filter while the bind's password
41-
is set to None
40+
The bind's password argument is set to None
4241
"""
4342

44-
dn = request.args['dc']
45-
search_filter = request.args['search']
43+
dn = "dc={}".format(ldap.dn.escape_dn_chars(request.args['dc']))
44+
search_filter = "(user={})".format(ldap.filter.escape_filter_chars(request.args['search']))
4645

4746
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
4847
ldap_connection.bind_s('cn=root', None)
@@ -51,12 +50,11 @@ def bind_s_example():
5150
@app.route("/bind_s_example")
5251
def bind_s_example_kwargs():
5352
"""
54-
A RemoteFlowSource is used directly as DN and search filter while the bind's password
55-
is set to None
53+
The bind's password argument is set to None
5654
"""
5755

58-
dn = request.args['dc']
59-
search_filter = request.args['search']
56+
dn = "dc={}".format(ldap.dn.escape_dn_chars(request.args['dc']))
57+
search_filter = "(user={})".format(ldap.filter.escape_filter_chars(request.args['search']))
6058

6159
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
6260
ldap_connection.bind_s(who='cn=root', cred=None)
@@ -65,12 +63,11 @@ def bind_s_example_kwargs():
6563
@app.route("/bind_example")
6664
def bind_example():
6765
"""
68-
A RemoteFlowSource is used directly as DN and search filter while the bind's password
69-
is set to None
66+
The bind's password argument is an empty string
7067
"""
7168

72-
dn = request.args['dc']
73-
search_filter = request.args['search']
69+
dn = "dc={}".format(ldap.dn.escape_dn_chars(request.args['dc']))
70+
search_filter = "(user={})".format(ldap.filter.escape_filter_chars(request.args['search']))
7471

7572
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
7673
ldap_connection.bind('cn=root', "")
@@ -80,12 +77,11 @@ def bind_example():
8077
@app.route("/bind_example")
8178
def bind_example():
8279
"""
83-
A RemoteFlowSource is used directly as DN and search filter while the bind's password
84-
is set to None
80+
The bind's password argument is an empty string
8581
"""
8682

87-
dn = request.args['dc']
88-
search_filter = request.args['search']
83+
dn = "dc={}".format(ldap.dn.escape_dn_chars(request.args['dc']))
84+
search_filter = "(user={})".format(ldap.filter.escape_filter_chars(request.args['search']))
8985

9086
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
9187
ldap_connection.bind(who='cn=root', cred="")

‎python/ql/test/experimental/query-tests/Security/CWE-287/auth_bad_3.py

Lines changed: 14 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,19 @@
11
from ldap3 import Server, Connection, ALL
22
from flask import request, Flask
3+
from ldap3.utils.dn import escape_rdn
4+
from ldap3.utils.conv import escape_filter_chars
35

46
app = Flask(__name__)
57

68

79
@app.route("/passwordNone")
810
def passwordNone():
911
"""
10-
A RemoteFlowSource is used directly as DN and search filter while the connection's password
11-
is set to None
12+
The bind's password argument is set to None
1213
"""
1314

14-
dn = request.args['dc']
15-
search_filter = request.args['search']
15+
dn = "dc={}".format(escape_rdn(request.args['dc']))
16+
search_filter = "(user={})".format(escape_filter_chars(request.args['search']))
1617

1718
srv = Server('servername', get_info=ALL)
1819
conn = Connection(srv, 'user_dn', None)
@@ -22,12 +23,11 @@ def passwordNone():
2223
@app.route("/passwordNone")
2324
def passwordNoneKwargs():
2425
"""
25-
A RemoteFlowSource is used directly as DN and search filter while the connection's password
26-
is set to None
26+
The bind's password argument is set to None
2727
"""
2828

29-
dn = request.args['dc']
30-
search_filter = request.args['search']
29+
dn = "dc={}".format(escape_rdn(request.args['dc']))
30+
search_filter = "(user={})".format(escape_filter_chars(request.args['search']))
3131

3232
srv = Server('servername', get_info=ALL)
3333
conn = Connection(srv, user='user_dn', password=None)
@@ -36,12 +36,11 @@ def passwordNoneKwargs():
3636
@app.route("/passwordEmpty")
3737
def passwordEmpty():
3838
"""
39-
A RemoteFlowSource is used directly as DN and search filter while the connection's password
40-
is empty
39+
The bind's password argument is an empty string
4140
"""
4241

43-
dn = request.args['dc']
44-
search_filter = request.args['search']
42+
dn = "dc={}".format(escape_rdn(request.args['dc']))
43+
search_filter = "(user={})".format(escape_filter_chars(request.args['search']))
4544

4645
srv = Server('servername', get_info=ALL)
4746
conn = Connection(srv, user='user_dn', password="")
@@ -51,12 +50,11 @@ def passwordEmpty():
5150
@app.route("/notPassword")
5251
def notPassword():
5352
"""
54-
A RemoteFlowSource is used directly as DN and search filter while the connection's password
55-
is not set
53+
The bind's password argument is not set
5654
"""
5755

58-
dn = request.args['dc']
59-
search_filter = request.args['search']
56+
dn = "dc={}".format(escape_rdn(request.args['dc']))
57+
search_filter = "(user={})".format(escape_filter_chars(request.args['search']))
6058

6159
srv = Server('servername', get_info=ALL)
6260
conn = Connection(srv, user='user_dn')

‎python/ql/test/experimental/query-tests/Security/CWE-287/auth_good_2.py

Lines changed: 18 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,67 +1,64 @@
11
from flask import request, Flask
22
import ldap
3-
import os
3+
import ldap.filter
4+
import ldap.dn
45

56
app = Flask(__name__)
67

78

89
@app.route("/simple_bind_example")
910
def simple_bind_example():
1011
"""
11-
A RemoteFlowSource is used directly as DN and search filter while the bind's password
12-
is an environment variable
12+
The bind's password argument is a non-empty string
1313
"""
1414

15-
dn = request.args['dc']
16-
search_filter = request.args['search']
15+
dn = "dc={}".format(ldap.dn.escape_dn_chars(request.args['dc']))
16+
search_filter = "(user={})".format(ldap.filter.escape_filter_chars(request.args['search']))
1717

1818
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
19-
ldap_connection.simple_bind('cn=root', os.environ.get('LDAP_PASSWORD'))
19+
ldap_connection.simple_bind('cn=root', "SecurePa$$!")
2020
user = ldap_connection.search_s(dn, ldap.SCOPE_SUBTREE, search_filter)
2121

2222

2323
@app.route("/simple_bind_s_example")
2424
def simple_bind_s_example():
2525
"""
26-
A RemoteFlowSource is used directly as DN and search filter while the bind's password
27-
is an environment variable
26+
The bind's password argument is a non-empty string
2827
"""
2928

30-
dn = request.args['dc']
31-
search_filter = request.args['search']
29+
dn = "dc={}".format(ldap.dn.escape_dn_chars(request.args['dc']))
30+
search_filter = "(user={})".format(ldap.filter.escape_filter_chars(request.args['search']))
3231

3332
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
34-
ldap_connection.simple_bind_s('cn=root', os.environ.get('LDAP_PASSWORD'))
33+
ldap_connection.simple_bind_s('cn=root', "SecurePa$$!")
3534
user = ldap_connection.search_s(dn, ldap.SCOPE_SUBTREE, search_filter)
3635

3736

3837
@app.route("/bind_s_example")
3938
def bind_s_example():
4039
"""
41-
A RemoteFlowSource is used directly as DN and search filter while the bind's password
42-
is an environment variable
40+
The bind's password argument is a non-empty string
4341
"""
4442

45-
dn = request.args['dc']
46-
search_filter = request.args['search']
43+
dn = "dc={}".format(ldap.dn.escape_dn_chars(request.args['dc']))
44+
search_filter = "(user={})".format(ldap.filter.escape_filter_chars(request.args['search']))
4745

4846
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
49-
ldap_connection.bind_s('cn=root', os.environ.get('LDAP_PASSWORD'))
47+
ldap_connection.bind_s('cn=root', "SecurePa$$!")
5048
user = ldap_connection.search_s(dn, ldap.SCOPE_SUBTREE, search_filter)
5149

5250

5351
@app.route("/bind_example")
5452
def bind_example():
5553
"""
56-
A RemoteFlowSource is used directly as DN and search filter while the bind's password
57-
is an environment variable
54+
The bind's password argument is a non-empty string
5855
"""
5956

60-
dn = request.args['dc']
61-
search_filter = request.args['search']
57+
dn = "dc={}".format(ldap.dn.escape_dn_chars(request.args['dc']))
58+
search_filter = "(user={})".format(ldap.filter.escape_filter_chars(request.args['search']))
6259

6360
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
64-
ldap_connection.bind('cn=root', os.environ.get('LDAP_PASSWORD'))
61+
ldap_connection.bind('cn=root', "SecurePa$$!")
6562
user = ldap_connection.search_s(dn, ldap.SCOPE_SUBTREE, search_filter)
6663

6764
# if __name__ == "__main__":

‎python/ql/test/experimental/query-tests/Security/CWE-287/auth_good_3.py

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
11
from ldap3 import Server, Connection, ALL
22
from flask import request, Flask
3-
import os
3+
from ldap3.utils.dn import escape_rdn
4+
from ldap3.utils.conv import escape_filter_chars
45

56
app = Flask(__name__)
67

78

89
@app.route("/passwordFromEnv")
910
def passwordFromEnv():
1011
"""
11-
A RemoteFlowSource is used directly as DN and search filter while the connection's password
12-
is an environment variable
12+
The bind's password argument is a non-empty string
1313
"""
1414

15-
dn = request.args['dc']
16-
search_filter = request.args['search']
15+
dn = "dc={}".format(escape_rdn(request.args['dc']))
16+
search_filter = "(user={})".format(escape_filter_chars(request.args['search']))
1717

1818
srv = Server('servername', get_info=ALL)
1919
conn = Connection(srv, user='user_dn',
20-
password=os.environ.get('LDAP_PASSWORD'))
20+
password="SecurePa$$!")
2121
status, result, response, _ = conn.search(dn, search_filter)
2222

2323
# if __name__ == "__main__":

0 commit comments

Comments
 (0)