3
3
async def test_taint (request : web .Request ): # $ requestHandler
4
4
5
5
ensure_tainted (
6
+ # see https://docs.aiohttp.org/en/stable/web_reference.html#request-and-base-request
6
7
request , # $ tainted
7
8
8
9
# yarl.URL (see `yarl` framework tests)
@@ -32,10 +33,7 @@ async def test_taint(request: web.Request): # $ requestHandler
32
33
request .headers , # $ tainted
33
34
request .headers .getone ("key" ), # $ tainted
34
35
35
- # https://docs.python.org/3/library/asyncio-protocol.html#asyncio-transport
36
- # TODO
37
- request .transport , # $ tainted
38
- request .transport .get_extra_info ("key" ), # $ MISSING: tainted
36
+
39
37
40
38
# dict-like (readonly)
41
39
request .cookies , # $ tainted
@@ -50,9 +48,22 @@ async def test_taint(request: web.Request): # $ requestHandler
50
48
51
49
# aiohttp.StreamReader
52
50
# see https://docs.aiohttp.org/en/stable/streams.html#aiohttp.StreamReader
53
- # TODO
54
51
request .content , # $ tainted
52
+ await request .content .read (), # $ MISSING: tainted
53
+ await request .content .readany (), # $ MISSING: tainted
54
+ await request .content .readexactly (42 ), # $ MISSING: tainted
55
+ await request .content .readline (), # $ MISSING: tainted
56
+ await request .content .readchunk (), # $ MISSING: tainted
57
+ (await request .content .readchunk ())[0 ], # $ MISSING: tainted
58
+ [line async for line in request .content ], # $ MISSING: tainted
59
+ [data async for data in request .content .iter_chunked (1024 )], # $ MISSING: tainted
60
+ [data async for data in request .content .iter_any ()], # $ MISSING: tainted
61
+ [data async for data , _ in request .content .iter_chunks ()], # $ MISSING: tainted
62
+ request .content .read_nowait (), # $ MISSING: tainted
63
+
64
+ # aiohttp.StreamReader
55
65
request ._payload , # $ tainted
66
+ await request ._payload .readany (), # $ MISSING: tainted
56
67
57
68
request .content_type , # $ tainted
58
69
request .charset , # $ tainted
@@ -66,9 +77,19 @@ async def test_taint(request: web.Request): # $ requestHandler
66
77
67
78
request .clone (scheme = "https" ), # $ tainted
68
79
69
- # TODO: like request.transport.get_extra_info
80
+ # asyncio.Transport
81
+ # https://docs.python.org/3/library/asyncio-protocol.html#asyncio-transport
82
+ # example given in https://docs.aiohttp.org/en/stable/web_reference.html#aiohttp.web.BaseRequest.transport
83
+ # uses `peername` to get IP address of client
84
+ request .transport , # $ tainted
85
+ request .transport .get_extra_info ("key" ), # $ MISSING: tainted
86
+
87
+ # Like request.transport.get_extra_info
70
88
request .get_extra_info ("key" ), # $ tainted
71
89
90
+ # Like request.transport.get_extra_info
91
+ request .protocol .transport .get_extra_info ("key" ), # $ MISSING: tainted
92
+
72
93
# bytes
73
94
await request .read (), # $ tainted
74
95
0 commit comments