Skip to content

Commit 37d6ff7

Browse files
jorgectfjorgectf
committed
Update tests and .expected
1 parent 9e9678b commit 37d6ff7

File tree

9 files changed

+206
-164
lines changed

9 files changed

+206
-164
lines changed

‎python/ql/src/experimental/Security/CWE-090/examples/example_bad1.py

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,12 @@
44

55
@app.route("/normal")
66
def normal():
7-
unsafe_dn = "dc=%s" % request.args['dc']
8-
unsafe_filter = "(user=%s)" % request.args['username']
7+
unsafe_dc = request.args['dc']
8+
unsafe_filter = request.args['username']
99

10-
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
10+
dn = "dc={}".format(unsafe_dc)
11+
search_filter = "(user={})".format(unsafe_filter)
12+
13+
ldap_connection = ldap.initialize("ldap://127.0.0.1")
1114
user = ldap_connection.search_s(
12-
unsafe_dn, ldap.SCOPE_SUBTREE, unsafe_filter)
15+
dn, ldap.SCOPE_SUBTREE, search_filter)

‎python/ql/src/experimental/Security/CWE-090/examples/example_bad2.py

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,12 @@
44

55
@app.route("/normal")
66
def normal():
7-
unsafe_dn = "dc=%s" % request.args['dc']
8-
unsafe_filter = "(user=%s)" % request.args['username']
7+
unsafe_dc = request.args['dc']
8+
unsafe_filter = request.args['username']
99

10-
srv = ldap3.Server('ldap://127.0.0.1', port=1337)
11-
conn = ldap3.Connection(srv, user=unsafe_dn, auto_bind=True)
12-
conn.search(unsafe_dn, unsafe_filter)
10+
dn = "dc={}".format(unsafe_dc)
11+
search_filter = "(user={})".format(unsafe_filter)
12+
13+
srv = ldap3.Server('ldap://127.0.0.1')
14+
conn = ldap3.Connection(srv, user=dn, auto_bind=True)
15+
conn.search(dn, search_filter)

‎python/ql/src/experimental/Security/CWE-090/examples/example_good1.py

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,15 @@
66

77
@app.route("/normal")
88
def normal():
9-
unsafe_dn = "dc=%s" % request.args['dc']
10-
unsafe_filter = "(user=%s)" % request.args['username']
9+
unsafe_dc = request.args['dc']
10+
unsafe_filter = request.args['username']
1111

12-
safe_dn = ldap.dn.escape_dn_chars(unsafe_dn)
12+
safe_dc = ldap.dn.escape_dn_chars(unsafe_dc)
1313
safe_filter = ldap.filter.escape_filter_chars(unsafe_filter)
1414

15-
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
15+
dn = "dc={}".format(safe_dc)
16+
search_filter = "(user={})".format(safe_filter)
17+
18+
ldap_connection = ldap.initialize("ldap://127.0.0.1")
1619
user = ldap_connection.search_s(
17-
safe_dn, ldap.SCOPE_SUBTREE, safe_filter)
20+
dn, ldap.SCOPE_SUBTREE, search_filter)

‎python/ql/src/experimental/Security/CWE-090/examples/example_good2.py

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,15 @@
66

77
@app.route("/normal")
88
def normal():
9-
unsafe_dn = "dc=%s" % request.args['dc']
10-
unsafe_filter = "(user=%s)" % request.args['username']
9+
unsafe_dc = request.args['dc']
10+
unsafe_filter = request.args['username']
1111

12-
safe_dn = escape_rdn(unsafe_dn)
12+
safe_dc = escape_rdn(unsafe_dc)
1313
safe_filter = escape_filter_chars(unsafe_filter)
1414

15-
srv = ldap3.Server('ldap://127.0.0.1', port=1337)
16-
conn = ldap3.Connection(srv, user=safe_dn, auto_bind=True)
17-
conn.search(safe_dn, safe_filter)
15+
dn = "dc={}".format(safe_dc)
16+
search_filter = "(user={})".format(safe_filter)
17+
18+
srv = ldap3.Server('ldap://127.0.0.1')
19+
conn = ldap3.Connection(srv, user=dn, auto_bind=True)
20+
conn.search(dn, search_filter)

‎python/ql/test/experimental/query-tests/Security/CWE-090/LDAPInjection.expected

Lines changed: 95 additions & 95 deletions
Large diffs are not rendered by default.

‎python/ql/test/experimental/query-tests/Security/CWE-090/ldap3_bad.py

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,15 @@ def normal():
1010
A RemoteFlowSource is used directly as DN and search filter
1111
"""
1212

13-
unsafe_dn = "dc=%s" % request.args['dc']
14-
unsafe_filter = "(user=%s)" % request.args['username']
13+
unsafe_dc = request.args['dc']
14+
unsafe_filter = request.args['username']
1515

16-
srv = ldap3.Server('ldap://127.0.0.1', port=1337)
17-
conn = ldap3.Connection(srv, user=unsafe_dn, auto_bind=True)
18-
conn.search(unsafe_dn, unsafe_filter)
16+
dn = "dc={}".format(unsafe_dc)
17+
search_filter = "(user={})".format(unsafe_filter)
18+
19+
srv = ldap3.Server('ldap://127.0.0.1')
20+
conn = ldap3.Connection(srv, user=dn, auto_bind=True)
21+
conn.search(dn, search_filter)
1922

2023

2124
@app.route("/direct")
@@ -24,12 +27,15 @@ def direct():
2427
A RemoteFlowSource is used directly as DN and search filter using a oneline call to .search
2528
"""
2629

27-
unsafe_dn = "dc=%s" % request.args['dc']
28-
unsafe_filter = "(user=%s)" % request.args['username']
30+
unsafe_dc = request.args['dc']
31+
unsafe_filter = request.args['username']
32+
33+
dn = "dc={}".format(unsafe_dc)
34+
search_filter = "(user={})".format(unsafe_filter)
2935

30-
srv = ldap3.Server('ldap://127.0.0.1', port=1337)
31-
conn = ldap3.Connection(srv, user=unsafe_dn, auto_bind=True).search(
32-
unsafe_dn, unsafe_filter)
36+
srv = ldap3.Server('ldap://127.0.0.1')
37+
conn = ldap3.Connection(srv, user=dn, auto_bind=True).search(
38+
dn, search_filter)
3339

3440
# if __name__ == "__main__":
3541
# app.run(debug=True)

‎python/ql/test/experimental/query-tests/Security/CWE-090/ldap3_good.py

Lines changed: 18 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,18 @@ def normal():
1212
A RemoteFlowSource is sanitized and used as DN and search filter
1313
"""
1414

15-
unsafe_dn = "dc=%s" % request.args['dc']
16-
unsafe_filter = "(user=%s)" % request.args['username']
15+
unsafe_dc = request.args['dc']
16+
unsafe_filter = request.args['username']
1717

18-
safe_dn = escape_rdn(unsafe_dn)
18+
safe_dc = escape_rdn(unsafe_dc)
1919
safe_filter = escape_filter_chars(unsafe_filter)
2020

21-
srv = ldap3.Server('ldap://127.0.0.1', port=1337)
22-
conn = ldap3.Connection(srv, user=safe_dn, auto_bind=True)
23-
conn.search(safe_dn, safe_filter)
21+
dn = "dc={}".format(safe_dc)
22+
search_filter = "(user={})".format(safe_filter)
23+
24+
srv = ldap3.Server('ldap://127.0.0.1')
25+
conn = ldap3.Connection(srv, user=dn, auto_bind=True)
26+
conn.search(dn, search_filter)
2427

2528

2629
@app.route("/direct")
@@ -29,15 +32,18 @@ def direct():
2932
A RemoteFlowSource is sanitized and used as DN and search filter using a oneline call to .search
3033
"""
3134

32-
unsafe_dn = "dc=%s" % request.args['dc']
33-
unsafe_filter = "(user=%s)" % request.args['username']
35+
unsafe_dc = request.args['dc']
36+
unsafe_filter = request.args['username']
3437

35-
safe_dn = escape_rdn(unsafe_dn)
38+
safe_dc = escape_rdn(unsafe_dc)
3639
safe_filter = escape_filter_chars(unsafe_filter)
3740

38-
srv = ldap3.Server('ldap://127.0.0.1', port=1337)
39-
conn = ldap3.Connection(srv, user=safe_dn, auto_bind=True).search(
40-
safe_dn, safe_filter)
41+
dn = "dc={}".format(safe_dc)
42+
search_filter = "(user={})".format(safe_filter)
43+
44+
srv = ldap3.Server('ldap://127.0.0.1')
45+
conn = ldap3.Connection(srv, user=dn, auto_bind=True).search(
46+
dn, search_filter)
4147

4248
# if __name__ == "__main__":
4349
# app.run(debug=True)

‎python/ql/test/experimental/query-tests/Security/CWE-090/ldap_bad.py

Lines changed: 21 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,15 @@ def normal():
1010
A RemoteFlowSource is used directly as DN and search filter
1111
"""
1212

13-
unsafe_dn = "dc=%s" % request.args['dc']
14-
unsafe_filter = "(user=%s)" % request.args['username']
13+
unsafe_dc = request.args['dc']
14+
unsafe_filter = request.args['username']
1515

16-
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
16+
dn = "dc={}".format(unsafe_dc)
17+
search_filter = "(user={})".format(unsafe_filter)
18+
19+
ldap_connection = ldap.initialize("ldap://127.0.0.1")
1720
user = ldap_connection.search_s(
18-
unsafe_dn, ldap.SCOPE_SUBTREE, unsafe_filter)
21+
dn, ldap.SCOPE_SUBTREE, search_filter)
1922

2023

2124
@app.route("/direct")
@@ -24,11 +27,14 @@ def direct():
2427
A RemoteFlowSource is used directly as DN and search filter using a oneline call to .search_s
2528
"""
2629

27-
unsafe_dn = "dc=%s" % request.args['dc']
28-
unsafe_filter = "(user=%s)" % request.args['username']
30+
unsafe_dc = request.args['dc']
31+
unsafe_filter = request.args['username']
32+
33+
dn = "dc={}".format(unsafe_dc)
34+
search_filter = "(user={})".format(unsafe_filter)
2935

30-
user = ldap.initialize("ldap://127.0.0.1:1337").search_s(
31-
unsafe_dn, ldap.SCOPE_SUBTREE, unsafe_filter)
36+
user = ldap.initialize("ldap://127.0.0.1").search_s(
37+
dn, ldap.SCOPE_SUBTREE, search_filter)
3238

3339

3440
@app.route("/normal_argbyname")
@@ -38,12 +44,15 @@ def normal_argbyname():
3844
an argument by name
3945
"""
4046

41-
unsafe_dn = "dc=%s" % request.args['dc']
42-
unsafe_filter = "(user=%s)" % request.args['username']
47+
unsafe_dc = request.args['dc']
48+
unsafe_filter = request.args['username']
49+
50+
dn = "dc={}".format(unsafe_dc)
51+
search_filter = "(user={})".format(unsafe_filter)
4352

44-
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
53+
ldap_connection = ldap.initialize("ldap://127.0.0.1")
4554
user = ldap_connection.search_s(
46-
unsafe_dn, ldap.SCOPE_SUBTREE, filterstr=unsafe_filter)
55+
dn, ldap.SCOPE_SUBTREE, filterstr=search_filter)
4756

4857

4958
# if __name__ == "__main__":

‎python/ql/test/experimental/query-tests/Security/CWE-090/ldap_good.py

Lines changed: 24 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,18 @@ def normal():
1212
A RemoteFlowSource is sanitized and used as DN and search filter
1313
"""
1414

15-
unsafe_dn = "dc=%s" % request.args['dc']
16-
unsafe_filter = "(user=%s)" % request.args['username']
15+
unsafe_dc = request.args['dc']
16+
unsafe_filter = request.args['username']
1717

18-
safe_dn = ldap.dn.escape_dn_chars(unsafe_dn)
18+
safe_dc = ldap.dn.escape_dn_chars(unsafe_dc)
1919
safe_filter = ldap.filter.escape_filter_chars(unsafe_filter)
2020

21-
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
21+
dn = "dc={}".format(safe_dc)
22+
search_filter = "(user={})".format(safe_filter)
23+
24+
ldap_connection = ldap.initialize("ldap://127.0.0.1")
2225
user = ldap_connection.search_s(
23-
safe_dn, ldap.SCOPE_SUBTREE, safe_filter)
26+
dn, ldap.SCOPE_SUBTREE, search_filter)
2427

2528

2629
@app.route("/direct")
@@ -29,14 +32,17 @@ def direct():
2932
A RemoteFlowSource is sanitized and used as DN and search filter using a oneline call to .search_s
3033
"""
3134

32-
unsafe_dn = "dc=%s" % request.args['dc']
33-
unsafe_filter = "(user=%s)" % request.args['username']
35+
unsafe_dc = request.args['dc']
36+
unsafe_filter = request.args['username']
3437

35-
safe_dn = ldap.dn.escape_dn_chars(unsafe_dn)
38+
safe_dc = ldap.dn.escape_dn_chars(unsafe_dc)
3639
safe_filter = ldap.filter.escape_filter_chars(unsafe_filter)
3740

38-
user = ldap.initialize("ldap://127.0.0.1:1337").search_s(
39-
safe_dn, ldap.SCOPE_SUBTREE, safe_filter, ["testAttr1", "testAttr2"])
41+
dn = "dc={}".format(safe_dc)
42+
search_filter = "(user={})".format(safe_filter)
43+
44+
user = ldap.initialize("ldap://127.0.0.1").search_s(
45+
dn, ldap.SCOPE_SUBTREE, search_filter, ["testAttr1", "testAttr2"])
4046

4147

4248
@app.route("/normal_argbyname")
@@ -46,15 +52,18 @@ def normal_argbyname():
4652
an argument by name
4753
"""
4854

49-
unsafe_dn = "dc=%s" % request.args['dc']
50-
unsafe_filter = "(user=%s)" % request.args['username']
55+
unsafe_dc = request.args['dc']
56+
unsafe_filter = request.args['username']
5157

52-
safe_dn = ldap.dn.escape_dn_chars(unsafe_dn)
58+
safe_dc = ldap.dn.escape_dn_chars(unsafe_dc)
5359
safe_filter = ldap.filter.escape_filter_chars(unsafe_filter)
5460

55-
ldap_connection = ldap.initialize("ldap://127.0.0.1:1337")
61+
dn = "dc={}".format(safe_dc)
62+
search_filter = "(user={})".format(safe_filter)
63+
64+
ldap_connection = ldap.initialize("ldap://127.0.0.1")
5665
user = ldap_connection.search_s(
57-
safe_dn, ldap.SCOPE_SUBTREE, filterstr=safe_filter)
66+
dn, ldap.SCOPE_SUBTREE, filterstr=search_filter)
5867

5968

6069
# if __name__ == "__main__":

0 commit comments

Comments
 (0)