Skip to content

Commit 24687b4

Browse files
committed
Python: Add test highlighting missing routed parameter flow to **kwargs parameter of request handler function
1 parent 8b23140 commit 24687b4

File tree

1 file changed

+12
-0
lines changed
  • python/ql/test/library-tests/frameworks/django-v2-v3

1 file changed

+12
-0
lines changed

python/ql/test/library-tests/frameworks/django-v2-v3/taint_test.py

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,8 +174,20 @@ def some_method(self):
174174
)
175175

176176

177+
def kwargs_param(request, **kwargs): # $ requestHandler
178+
ensure_tainted(
179+
kwargs, # $ MISSING: tainted
180+
kwargs["foo"], # $ MISSING: tainted
181+
kwargs["bar"] # $ MISSING: tainted
182+
)
183+
184+
ensure_tainted(request) # $ tainted
185+
186+
177187
# fake setup, you can't actually run this
178188
urlpatterns = [
179189
path("test-taint/<foo>/<bar>", test_taint), # $ routeSetup="test-taint/<foo>/<bar>"
180190
path("ClassView/", ClassView.as_view()), # $ routeSetup="ClassView/"
191+
path("test-kwargs_param/<foo>/<bar>", kwargs_param), # $ routeSetup="test-kwargs_param/<foo>/<bar>"
192+
181193
]

0 commit comments

Comments
 (0)