Skip to content

Commit 2d31ef7

Browse files
committed
Python: Fix last TODOs in aiohttp tests
1 parent 64a0e3f commit 2d31ef7

File tree

1 file changed

+27
-6
lines changed

1 file changed

+27
-6
lines changed

python/ql/test/library-tests/frameworks/aiohttp/taint_test.py

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
async def test_taint(request: web.Request): # $ requestHandler
44

55
ensure_tainted(
6+
# see https://docs.aiohttp.org/en/stable/web_reference.html#request-and-base-request
67
request, # $ tainted
78

89
# yarl.URL (see `yarl` framework tests)
@@ -32,10 +33,7 @@ async def test_taint(request: web.Request): # $ requestHandler
3233
request.headers, # $ tainted
3334
request.headers.getone("key"), # $ tainted
3435

35-
# https://docs.python.org/3/library/asyncio-protocol.html#asyncio-transport
36-
# TODO
37-
request.transport, # $ tainted
38-
request.transport.get_extra_info("key"), # $ MISSING: tainted
36+
3937

4038
# dict-like (readonly)
4139
request.cookies, # $ tainted
@@ -50,9 +48,22 @@ async def test_taint(request: web.Request): # $ requestHandler
5048

5149
# aiohttp.StreamReader
5250
# see https://docs.aiohttp.org/en/stable/streams.html#aiohttp.StreamReader
53-
# TODO
5451
request.content, # $ tainted
52+
await request.content.read(), # $ MISSING: tainted
53+
await request.content.readany(), # $ MISSING: tainted
54+
await request.content.readexactly(42), # $ MISSING: tainted
55+
await request.content.readline(), # $ MISSING: tainted
56+
await request.content.readchunk(), # $ MISSING: tainted
57+
(await request.content.readchunk())[0], # $ MISSING: tainted
58+
[line async for line in request.content], # $ MISSING: tainted
59+
[data async for data in request.content.iter_chunked(1024)], # $ MISSING: tainted
60+
[data async for data in request.content.iter_any()], # $ MISSING: tainted
61+
[data async for data, _ in request.content.iter_chunks()], # $ MISSING: tainted
62+
request.content.read_nowait(), # $ MISSING: tainted
63+
64+
# aiohttp.StreamReader
5565
request._payload, # $ tainted
66+
await request._payload.readany(), # $ MISSING: tainted
5667

5768
request.content_type, # $ tainted
5869
request.charset, # $ tainted
@@ -66,9 +77,19 @@ async def test_taint(request: web.Request): # $ requestHandler
6677

6778
request.clone(scheme="https"), # $ tainted
6879

69-
# TODO: like request.transport.get_extra_info
80+
# asyncio.Transport
81+
# https://docs.python.org/3/library/asyncio-protocol.html#asyncio-transport
82+
# example given in https://docs.aiohttp.org/en/stable/web_reference.html#aiohttp.web.BaseRequest.transport
83+
# uses `peername` to get IP address of client
84+
request.transport, # $ tainted
85+
request.transport.get_extra_info("key"), # $ MISSING: tainted
86+
87+
# Like request.transport.get_extra_info
7088
request.get_extra_info("key"), # $ tainted
7189

90+
# Like request.transport.get_extra_info
91+
request.protocol.transport.get_extra_info("key"), # $ MISSING: tainted
92+
7293
# bytes
7394
await request.read(), # $ tainted
7495

0 commit comments

Comments
 (0)