Skip to content

Commit 597a9df

Browse files
committed
Python: Don't consider has_body tainted
Although it technically is, I think it belong in the section of things that are unlikely to be exploitable
1 parent d953ea4 commit 597a9df

File tree

2 files changed

+5
-6
lines changed

2 files changed

+5
-6
lines changed

python/ql/src/semmle/python/frameworks/Aiohttp.qll

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -224,9 +224,8 @@ module AiohttpWebModel {
224224
nodeTo.(DataFlow::AttrRead).getObject() = nodeFrom and
225225
nodeTo.(DataFlow::AttrRead).getAttributeName() in [
226226
"url", "rel_url", "forwarded", "host", "remote", "path", "path_qs", "raw_path", "query",
227-
"headers", "transport", "cookies", "content", "_payload", "body_exists", "has_body",
228-
"content_type", "charset", "http_range", "if_modified_since", "if_unmodified_since",
229-
"if_range"
227+
"headers", "transport", "cookies", "content", "_payload", "content_type", "charset",
228+
"http_range", "if_modified_since", "if_unmodified_since", "if_range"
230229
]
231230
}
232231
}

python/ql/test/library-tests/frameworks/aiohttp/taint_test.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -66,9 +66,6 @@ async def test_taint(request: web.Request): # $ requestHandler
6666
request.content, # $ tainted
6767
request._payload, # $ tainted
6868

69-
request.body_exists, # $ tainted
70-
request.has_body, # $ tainted
71-
7269
request.content_type, # $ tainted
7370
request.charset, # $ tainted
7471

@@ -116,6 +113,9 @@ async def test_taint(request: web.Request): # $ requestHandler
116113
request.keep_alive,
117114

118115
request.content_length,
116+
request.body_exists,
117+
request.has_body,
118+
request.can_read_body,
119119
)
120120

121121
ensure_not_tainted(

0 commit comments

Comments
 (0)