|
11 | 11 | # Actual tests
|
12 | 12 |
|
13 | 13 | from io import StringIO
|
14 |
| - |
15 |
| -# Workaround for Python3 not having unicode |
16 |
| -import sys |
17 |
| -if sys.version_info[0] == 3: |
18 |
| - unicode = str |
| 14 | +import json |
19 | 15 |
|
20 | 16 | def test():
|
21 | 17 | print("\n# test")
|
22 | 18 | ts = TAINTED_STRING
|
23 |
| - import json |
| 19 | + |
| 20 | + encoded = json.dumps(ts) |
24 | 21 |
|
25 | 22 | ensure_tainted(
|
| 23 | + encoded, # $ tainted |
26 | 24 | json.dumps(ts), # $ tainted
|
27 |
| - json.loads(json.dumps(ts)), # $ tainted |
| 25 | + json.dumps(obj=ts), # $ MISSING: tainted |
| 26 | + json.loads(encoded), # $ tainted |
| 27 | + json.loads(s=encoded), # $ MISSING: tainted |
28 | 28 | )
|
29 | 29 |
|
30 |
| - # For Python2, need to convert to unicode for StringIO to work |
31 |
| - tainted_filelike = StringIO(unicode(json.dumps(ts))) |
| 30 | + # load/dump with file-like |
| 31 | + tainted_filelike = StringIO() |
| 32 | + json.dump(ts, tainted_filelike) |
32 | 33 |
|
| 34 | + tainted_filelike.seek(0) |
33 | 35 | ensure_tainted(
|
34 | 36 | tainted_filelike, # $ MISSING: tainted
|
35 | 37 | json.load(tainted_filelike), # $ MISSING: tainted
|
36 | 38 | )
|
37 | 39 |
|
38 |
| -def non_syntacical(): |
39 |
| - print("\n# non_syntacical") |
40 |
| - ts = TAINTED_STRING |
41 |
| - |
42 |
| - # a less syntactical approach |
43 |
| - from json import load, loads, dumps |
44 |
| - |
45 |
| - dumps_alias = dumps |
46 |
| - |
47 |
| - ensure_tainted( |
48 |
| - dumps(ts), # $ tainted |
49 |
| - dumps_alias(ts), # $ tainted |
50 |
| - loads(dumps(ts)), # $ tainted |
51 |
| - ) |
52 |
| - |
53 |
| - # For Python2, need to convert to unicode for StringIO to work |
54 |
| - tainted_filelike = StringIO(unicode(dumps(ts))) |
| 40 | + # load/dump with file-like using keyword-args |
| 41 | + tainted_filelike = StringIO() |
| 42 | + json.dump(obj=ts, fp=tainted_filelike) |
55 | 43 |
|
| 44 | + tainted_filelike.seek(0) |
56 | 45 | ensure_tainted(
|
57 | 46 | tainted_filelike, # $ MISSING: tainted
|
58 |
| - load(tainted_filelike), # $ MISSING: tainted |
| 47 | + json.load(fp=tainted_filelike), # $ MISSING: tainted |
59 | 48 | )
|
60 | 49 |
|
| 50 | + |
61 | 51 | # Make tests runable
|
62 | 52 |
|
63 | 53 | test()
|
64 |
| -non_syntacical() |
0 commit comments