Skip to content

Commit 784e0cd

Browse files
committed
Python: Improve tests of json module
Inspired by the work on previous commit
1 parent 3fe9a3d commit 784e0cd

File tree

1 file changed

+17
-28
lines changed
  • python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep

1 file changed

+17
-28
lines changed

python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_json.py

Lines changed: 17 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -11,54 +11,43 @@
1111
# Actual tests
1212

1313
from io import StringIO
14-
15-
# Workaround for Python3 not having unicode
16-
import sys
17-
if sys.version_info[0] == 3:
18-
unicode = str
14+
import json
1915

2016
def test():
2117
print("\n# test")
2218
ts = TAINTED_STRING
23-
import json
19+
20+
encoded = json.dumps(ts)
2421

2522
ensure_tainted(
23+
encoded, # $ tainted
2624
json.dumps(ts), # $ tainted
27-
json.loads(json.dumps(ts)), # $ tainted
25+
json.dumps(obj=ts), # $ MISSING: tainted
26+
json.loads(encoded), # $ tainted
27+
json.loads(s=encoded), # $ MISSING: tainted
2828
)
2929

30-
# For Python2, need to convert to unicode for StringIO to work
31-
tainted_filelike = StringIO(unicode(json.dumps(ts)))
30+
# load/dump with file-like
31+
tainted_filelike = StringIO()
32+
json.dump(ts, tainted_filelike)
3233

34+
tainted_filelike.seek(0)
3335
ensure_tainted(
3436
tainted_filelike, # $ MISSING: tainted
3537
json.load(tainted_filelike), # $ MISSING: tainted
3638
)
3739

38-
def non_syntacical():
39-
print("\n# non_syntacical")
40-
ts = TAINTED_STRING
41-
42-
# a less syntactical approach
43-
from json import load, loads, dumps
44-
45-
dumps_alias = dumps
46-
47-
ensure_tainted(
48-
dumps(ts), # $ tainted
49-
dumps_alias(ts), # $ tainted
50-
loads(dumps(ts)), # $ tainted
51-
)
52-
53-
# For Python2, need to convert to unicode for StringIO to work
54-
tainted_filelike = StringIO(unicode(dumps(ts)))
40+
# load/dump with file-like using keyword-args
41+
tainted_filelike = StringIO()
42+
json.dump(obj=ts, fp=tainted_filelike)
5543

44+
tainted_filelike.seek(0)
5645
ensure_tainted(
5746
tainted_filelike, # $ MISSING: tainted
58-
load(tainted_filelike), # $ MISSING: tainted
47+
json.load(fp=tainted_filelike), # $ MISSING: tainted
5948
)
6049

50+
6151
# Make tests runable
6252

6353
test()
64-
non_syntacical()

0 commit comments

Comments
 (0)