Python: Add tests of http.client.HTTPResponse

Author: RasmusWL

python/ql/test/library-tests/frameworks/stdlib/http_client.py

@@ -0,0 +1,158 @@
+import sys
+import ssl
+
+PY2 = sys.version_info[0] == 2
+PY3 = sys.version_info[0] == 3
+
+if PY2:
+    from httplib import HTTPConnection, HTTPSConnection
+if PY3:
+    from http.client import HTTPConnection, HTTPSConnection
+
+
+# NOTE: the URL may be relative to host, or may be full URL.
+conn = HTTPConnection("example.com") # $ MISSING: clientRequestUrl="example.com"
+conn.request("GET", "/") # $ MISSING: clientRequestUrl="/"
+conn.request("GET", "http://example.com/") # $ MISSING: clientRequestUrl="http://example.com/"
+
+# kwargs
+conn = HTTPConnection(host="example.com") # $ MISSING: clientRequestUrl="example.com"
+conn.request(method="GET", url="/") # $ MISSING: clientRequestUrl="/"
+
+# using internal method... you shouldn't but you can
+conn._send_request("GET", "url", body=None, headers={}, encode_chunked=False) # $ MISSING: clientRequestUrl="url"
+
+# low level sending of request
+conn.putrequest("GET", "url") # $ MISSING: clientRequestUrl="url"
+conn.putheader("X-Foo", "value")
+conn.endheaders(message_body=None)
+
+# HTTPS
+conn = HTTPSConnection("host") # $ MISSING: clientRequestUrl="host"
+conn.request("GET", "url") # $ MISSING: clientRequestUrl="url"
+
+# six aliases
+import six
+
+conn = six.moves.http_client.HTTPConnection("host") # $ MISSING: clientRequestUrl="host"
+conn.request("GET", "url") # $ MISSING: clientRequestUrl="url"
+
+conn = six.moves.http_client.HTTPSConnection("host") # $ MISSING: clientRequestUrl="host"
+conn.request("GET", "url") # $ MISSING: clientRequestUrl="url"
+
+# ==============================================================================
+# Certificate validation disabled
+# ==============================================================================
+
+# default SSL context is the one given by `_create_default_https_context`
+context = ssl._create_default_https_context()
+assert context.check_hostname == True
+assert context.verify_mode == ssl.CERT_REQUIRED
+
+conn = HTTPSConnection("host", context=context) # $ MISSING: clientRequestUrl="host"
+conn.request("GET", "url") # $ MISSING: clientRequestUrl="url"
+
+# `_create_default_https_context` is currently just an alias for `create_default_context`
+# which creates a context for SERVER_AUTH purpose.
+context = ssl.create_default_context()
+assert context.check_hostname == True
+assert context.verify_mode == ssl.CERT_REQUIRED
+
+conn = HTTPSConnection("host", context=context) # $ MISSING: clientRequestUrl="host"
+conn.request("GET", "url") # $ MISSING: clientRequestUrl="url"
+
+# however, if you supply your own SSLContext, you need to set it manually
+context = ssl.SSLContext()
+assert context.check_hostname == False
+assert context.verify_mode == ssl.CERT_NONE
+
+conn = HTTPSConnection("host", context=context) # $ MISSING: clientRequestUrl="host"
+conn.request("GET", "url") # $ MISSING: clientRequestUrl="url" clientRequestCertValidationDisabled
+
+# and if you misunderstood whether to use server/client in the purpose, you will also
+# get a context without hostname verification.
+context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
+assert context.check_hostname == False
+assert context.verify_mode == ssl.CERT_NONE
+
+conn = HTTPSConnection("host", context=context) # $ MISSING: clientRequestUrl="host"
+conn.request("GET", "url") # $ MISSING: clientRequestUrl="url" clientRequestCertValidationDisabled
+
+# NOTICE that current documentation says
+#
+# > Enabling hostname checking automatically sets verify_mode from CERT_NONE to
+# > CERT_REQUIRED. It cannot be set back to CERT_NONE as long as hostname checking is
+# > enabled.
+# - https://docs.python.org/3.10/library/ssl.html#ssl.SSLContext.check_hostname
+
+context = ssl.SSLContext()
+context.check_hostname = True
+assert context.verify_mode == ssl.CERT_REQUIRED
+
+conn = HTTPSConnection("host", context=context) # $ MISSING: clientRequestUrl="host"
+conn.request("GET", "url") # $ MISSING: clientRequestUrl="url"
+
+# only setting verify_mode is not enough, since check_hostname is not enabled
+
+context = ssl.SSLContext()
+context.verify_mode = ssl.CERT_REQUIRED
+assert context.check_hostname == False
+
+conn = HTTPSConnection("host", context=context) # $ MISSING: clientRequestUrl="host"
+conn.request("GET", "url") # $ MISSING: clientRequestUrl="url" clientRequestCertValidationDisabled
+
+# ==============================================================================
+# taint test
+# ==============================================================================
+
+from flask import request
+
+def taint_test():
+    host = request.args['host']
+    url = request.args['url']
+
+    conn = HTTPConnection(host) # $ MISSING: clientRequestUrl=host
+    conn.request("GET", url) # $ MISSING: clientRequestUrl=url
+
+    resp = conn.getresponse()
+
+    ensure_tainted(
+        # see
+        # https://docs.python.org/3.10/library/http.client.html#httpresponse-objects
+        # https://docs.python.org/3/library/http.client.html#http.client.HTTPResponse
+
+        # a HTTPResponse itself is file-like
+        resp, # $ MISSING: tainted
+        resp.read(), # $ MISSING: tainted
+
+        resp.getheader("name"), # $ MISSING: tainted
+        resp.getheaders(), # $ MISSING: tainted
+
+        # http.client.HTTPMessage
+        resp.headers, # $ MISSING: tainted
+        resp.headers.get_all(), # $ MISSING: tainted
+
+        # Alias for .headers
+        # http.client.HTTPMessage
+        resp.msg, # $ MISSING: tainted
+        resp.msg.get_all(), # $ MISSING: tainted
+
+        # Alias for .headers
+        resp.info(), # $ MISSING: tainted
+        resp.info().get_all(), # $ MISSING: tainted
+
+        # although this would usually be the textual version of the status
+        # ("OK" for 200), it is possible to put your own evil data in here.
+        resp.reason, # $ MISSING: tainted
+
+        # the URL of the recourse that was visited, if redirects were followed.
+        # I don't see any reason this could not contain evil data.
+        resp.url, # $ MISSING: tainted
+        resp.geturl(), # $ MISSING: tainted
+    )
+
+    ensure_not_tainted(
+        resp.status,
+        resp.code,
+        resp.getcode(),
+    )