Skip to content

Commit 9ca738d

Browse files
RasmusWLRasmusWL
committed
Python: Add taint test for self.request on django view class
1 parent ca0d345 commit 9ca738d

File tree

3 files changed

+101
-78
lines changed

3 files changed

+101
-78
lines changed

‎python/ql/test/experimental/library-tests/frameworks/django-v2-v3/TestTaint.expected

Lines changed: 83 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -1,82 +1,88 @@
1-
| taint_test.py:7 | ok | test_taint | bar |
2-
| taint_test.py:7 | ok | test_taint | foo |
3-
| taint_test.py:8 | ok | test_taint | baz |
4-
| taint_test.py:14 | ok | test_taint | request |
5-
| taint_test.py:16 | ok | test_taint | request.body |
6-
| taint_test.py:17 | ok | test_taint | request.path |
7-
| taint_test.py:18 | ok | test_taint | request.path_info |
8-
| taint_test.py:22 | ok | test_taint | request.method |
9-
| taint_test.py:24 | ok | test_taint | request.encoding |
10-
| taint_test.py:25 | ok | test_taint | request.content_type |
11-
| taint_test.py:28 | ok | test_taint | request.content_params |
12-
| taint_test.py:29 | ok | test_taint | request.content_params["key"] |
13-
| taint_test.py:30 | ok | test_taint | request.content_params.get(..) |
14-
| taint_test.py:34 | ok | test_taint | request.GET |
15-
| taint_test.py:35 | ok | test_taint | request.GET["key"] |
16-
| taint_test.py:36 | ok | test_taint | request.GET.get(..) |
17-
| taint_test.py:37 | fail | test_taint | request.GET.getlist(..) |
18-
| taint_test.py:38 | fail | test_taint | request.GET.getlist(..)[0] |
19-
| taint_test.py:39 | ok | test_taint | request.GET.pop(..) |
20-
| taint_test.py:40 | ok | test_taint | request.GET.pop(..)[0] |
21-
| taint_test.py:41 | ok | test_taint | request.GET.popitem()[0] |
22-
| taint_test.py:42 | ok | test_taint | request.GET.popitem()[1] |
23-
| taint_test.py:43 | ok | test_taint | request.GET.popitem()[1][0] |
24-
| taint_test.py:44 | fail | test_taint | request.GET.dict() |
25-
| taint_test.py:45 | fail | test_taint | request.GET.dict()["key"] |
26-
| taint_test.py:46 | fail | test_taint | request.GET.urlencode() |
27-
| taint_test.py:49 | ok | test_taint | request.POST |
28-
| taint_test.py:52 | ok | test_taint | request.COOKIES |
29-
| taint_test.py:53 | ok | test_taint | request.COOKIES["key"] |
30-
| taint_test.py:54 | ok | test_taint | request.COOKIES.get(..) |
31-
| taint_test.py:57 | ok | test_taint | request.FILES |
32-
| taint_test.py:58 | ok | test_taint | request.FILES["key"] |
33-
| taint_test.py:59 | fail | test_taint | request.FILES["key"].content_type |
34-
| taint_test.py:60 | fail | test_taint | request.FILES["key"].content_type_extra |
35-
| taint_test.py:61 | fail | test_taint | request.FILES["key"].content_type_extra["key"] |
36-
| taint_test.py:62 | fail | test_taint | request.FILES["key"].charset |
37-
| taint_test.py:63 | fail | test_taint | request.FILES["key"].name |
38-
| taint_test.py:64 | fail | test_taint | request.FILES["key"].file |
39-
| taint_test.py:65 | fail | test_taint | request.FILES["key"].file.read() |
40-
| taint_test.py:67 | ok | test_taint | request.FILES.get(..) |
41-
| taint_test.py:68 | fail | test_taint | request.FILES.get(..).name |
42-
| taint_test.py:69 | fail | test_taint | request.FILES.getlist(..) |
43-
| taint_test.py:70 | fail | test_taint | request.FILES.getlist(..)[0] |
44-
| taint_test.py:71 | fail | test_taint | request.FILES.getlist(..)[0].name |
45-
| taint_test.py:72 | fail | test_taint | request.FILES.dict() |
46-
| taint_test.py:73 | fail | test_taint | request.FILES.dict()["key"] |
47-
| taint_test.py:74 | fail | test_taint | request.FILES.dict()["key"].name |
48-
| taint_test.py:77 | ok | test_taint | request.META |
49-
| taint_test.py:78 | ok | test_taint | request.META["HTTP_USER_AGENT"] |
50-
| taint_test.py:79 | ok | test_taint | request.META.get(..) |
51-
| taint_test.py:82 | ok | test_taint | request.headers |
52-
| taint_test.py:83 | ok | test_taint | request.headers["user-agent"] |
53-
| taint_test.py:84 | ok | test_taint | request.headers["USER_AGENT"] |
54-
| taint_test.py:87 | ok | test_taint | request.resolver_match |
55-
| taint_test.py:88 | fail | test_taint | request.resolver_match.args |
56-
| taint_test.py:89 | fail | test_taint | request.resolver_match.args[0] |
57-
| taint_test.py:90 | fail | test_taint | request.resolver_match.kwargs |
58-
| taint_test.py:91 | fail | test_taint | request.resolver_match.kwargs["key"] |
59-
| taint_test.py:93 | fail | test_taint | request.get_full_path() |
60-
| taint_test.py:94 | fail | test_taint | request.get_full_path_info() |
61-
| taint_test.py:98 | fail | test_taint | request.read() |
62-
| taint_test.py:99 | fail | test_taint | request.readline() |
63-
| taint_test.py:100 | fail | test_taint | request.readlines() |
64-
| taint_test.py:101 | fail | test_taint | request.readlines()[0] |
65-
| taint_test.py:102 | fail | test_taint | ListComp |
66-
| taint_test.py:108 | ok | test_taint | args |
67-
| taint_test.py:109 | ok | test_taint | args[0] |
68-
| taint_test.py:110 | ok | test_taint | kwargs |
69-
| taint_test.py:111 | ok | test_taint | kwargs["key"] |
70-
| taint_test.py:115 | ok | test_taint | request.current_app |
71-
| taint_test.py:120 | ok | test_taint | request.get_host() |
72-
| taint_test.py:121 | ok | test_taint | request.get_port() |
73-
| taint_test.py:128 | fail | test_taint | request.build_absolute_uri() |
74-
| taint_test.py:129 | fail | test_taint | request.build_absolute_uri(..) |
1+
| taint_test.py:8 | ok | test_taint | bar |
2+
| taint_test.py:8 | ok | test_taint | foo |
3+
| taint_test.py:9 | ok | test_taint | baz |
4+
| taint_test.py:15 | ok | test_taint | request |
5+
| taint_test.py:17 | ok | test_taint | request.body |
6+
| taint_test.py:18 | ok | test_taint | request.path |
7+
| taint_test.py:19 | ok | test_taint | request.path_info |
8+
| taint_test.py:23 | ok | test_taint | request.method |
9+
| taint_test.py:25 | ok | test_taint | request.encoding |
10+
| taint_test.py:26 | ok | test_taint | request.content_type |
11+
| taint_test.py:29 | ok | test_taint | request.content_params |
12+
| taint_test.py:30 | ok | test_taint | request.content_params["key"] |
13+
| taint_test.py:31 | ok | test_taint | request.content_params.get(..) |
14+
| taint_test.py:35 | ok | test_taint | request.GET |
15+
| taint_test.py:36 | ok | test_taint | request.GET["key"] |
16+
| taint_test.py:37 | ok | test_taint | request.GET.get(..) |
17+
| taint_test.py:38 | fail | test_taint | request.GET.getlist(..) |
18+
| taint_test.py:39 | fail | test_taint | request.GET.getlist(..)[0] |
19+
| taint_test.py:40 | ok | test_taint | request.GET.pop(..) |
20+
| taint_test.py:41 | ok | test_taint | request.GET.pop(..)[0] |
21+
| taint_test.py:42 | ok | test_taint | request.GET.popitem()[0] |
22+
| taint_test.py:43 | ok | test_taint | request.GET.popitem()[1] |
23+
| taint_test.py:44 | ok | test_taint | request.GET.popitem()[1][0] |
24+
| taint_test.py:45 | fail | test_taint | request.GET.dict() |
25+
| taint_test.py:46 | fail | test_taint | request.GET.dict()["key"] |
26+
| taint_test.py:47 | fail | test_taint | request.GET.urlencode() |
27+
| taint_test.py:50 | ok | test_taint | request.POST |
28+
| taint_test.py:53 | ok | test_taint | request.COOKIES |
29+
| taint_test.py:54 | ok | test_taint | request.COOKIES["key"] |
30+
| taint_test.py:55 | ok | test_taint | request.COOKIES.get(..) |
31+
| taint_test.py:58 | ok | test_taint | request.FILES |
32+
| taint_test.py:59 | ok | test_taint | request.FILES["key"] |
33+
| taint_test.py:60 | fail | test_taint | request.FILES["key"].content_type |
34+
| taint_test.py:61 | fail | test_taint | request.FILES["key"].content_type_extra |
35+
| taint_test.py:62 | fail | test_taint | request.FILES["key"].content_type_extra["key"] |
36+
| taint_test.py:63 | fail | test_taint | request.FILES["key"].charset |
37+
| taint_test.py:64 | fail | test_taint | request.FILES["key"].name |
38+
| taint_test.py:65 | fail | test_taint | request.FILES["key"].file |
39+
| taint_test.py:66 | fail | test_taint | request.FILES["key"].file.read() |
40+
| taint_test.py:68 | ok | test_taint | request.FILES.get(..) |
41+
| taint_test.py:69 | fail | test_taint | request.FILES.get(..).name |
42+
| taint_test.py:70 | fail | test_taint | request.FILES.getlist(..) |
43+
| taint_test.py:71 | fail | test_taint | request.FILES.getlist(..)[0] |
44+
| taint_test.py:72 | fail | test_taint | request.FILES.getlist(..)[0].name |
45+
| taint_test.py:73 | fail | test_taint | request.FILES.dict() |
46+
| taint_test.py:74 | fail | test_taint | request.FILES.dict()["key"] |
47+
| taint_test.py:75 | fail | test_taint | request.FILES.dict()["key"].name |
48+
| taint_test.py:78 | ok | test_taint | request.META |
49+
| taint_test.py:79 | ok | test_taint | request.META["HTTP_USER_AGENT"] |
50+
| taint_test.py:80 | ok | test_taint | request.META.get(..) |
51+
| taint_test.py:83 | ok | test_taint | request.headers |
52+
| taint_test.py:84 | ok | test_taint | request.headers["user-agent"] |
53+
| taint_test.py:85 | ok | test_taint | request.headers["USER_AGENT"] |
54+
| taint_test.py:88 | ok | test_taint | request.resolver_match |
55+
| taint_test.py:89 | fail | test_taint | request.resolver_match.args |
56+
| taint_test.py:90 | fail | test_taint | request.resolver_match.args[0] |
57+
| taint_test.py:91 | fail | test_taint | request.resolver_match.kwargs |
58+
| taint_test.py:92 | fail | test_taint | request.resolver_match.kwargs["key"] |
59+
| taint_test.py:94 | fail | test_taint | request.get_full_path() |
60+
| taint_test.py:95 | fail | test_taint | request.get_full_path_info() |
61+
| taint_test.py:99 | fail | test_taint | request.read() |
62+
| taint_test.py:100 | fail | test_taint | request.readline() |
63+
| taint_test.py:101 | fail | test_taint | request.readlines() |
64+
| taint_test.py:102 | fail | test_taint | request.readlines()[0] |
65+
| taint_test.py:103 | fail | test_taint | ListComp |
66+
| taint_test.py:109 | ok | test_taint | args |
67+
| taint_test.py:110 | ok | test_taint | args[0] |
68+
| taint_test.py:111 | ok | test_taint | kwargs |
69+
| taint_test.py:112 | ok | test_taint | kwargs["key"] |
70+
| taint_test.py:116 | ok | test_taint | request.current_app |
71+
| taint_test.py:121 | ok | test_taint | request.get_host() |
72+
| taint_test.py:122 | ok | test_taint | request.get_port() |
73+
| taint_test.py:129 | fail | test_taint | request.build_absolute_uri() |
7574
| taint_test.py:130 | fail | test_taint | request.build_absolute_uri(..) |
76-
| taint_test.py:133 | ok | test_taint | request.build_absolute_uri(..) |
75+
| taint_test.py:131 | fail | test_taint | request.build_absolute_uri(..) |
7776
| taint_test.py:134 | ok | test_taint | request.build_absolute_uri(..) |
78-
| taint_test.py:142 | ok | test_taint | request.get_signed_cookie(..) |
77+
| taint_test.py:135 | ok | test_taint | request.build_absolute_uri(..) |
7978
| taint_test.py:143 | ok | test_taint | request.get_signed_cookie(..) |
8079
| taint_test.py:144 | ok | test_taint | request.get_signed_cookie(..) |
81-
| taint_test.py:148 | fail | test_taint | request.get_signed_cookie(..) |
80+
| taint_test.py:145 | ok | test_taint | request.get_signed_cookie(..) |
8281
| taint_test.py:149 | fail | test_taint | request.get_signed_cookie(..) |
82+
| taint_test.py:150 | fail | test_taint | request.get_signed_cookie(..) |
83+
| taint_test.py:157 | fail | some_method | self.request |
84+
| taint_test.py:158 | fail | some_method | self.request.GET["key"] |
85+
| taint_test.py:160 | fail | some_method | self.args |
86+
| taint_test.py:161 | fail | some_method | self.args[0] |
87+
| taint_test.py:163 | fail | some_method | self.kwargs |
88+
| taint_test.py:164 | fail | some_method | self.kwargs["key"] |

‎python/ql/test/experimental/library-tests/frameworks/django-v2-v3/taint_test.py

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
"""testing views for Django 2.x and 3.x"""
22
from django.urls import path
33
from django.http import HttpRequest
4+
from django.views import View
45

56

67
def test_taint(request: HttpRequest, foo, bar, baz=None): # $requestHandler routedParameter=foo routedParameter=bar
@@ -150,7 +151,22 @@ def test_taint(request: HttpRequest, foo, bar, baz=None): # $requestHandler rou
150151
)
151152

152153

154+
class ClassView(View):
155+
def some_method(self):
156+
ensure_tainted(
157+
self.request,
158+
self.request.GET["key"],
159+
160+
self.args,
161+
self.args[0],
162+
163+
self.kwargs,
164+
self.kwargs["key"],
165+
)
166+
167+
153168
# fake setup, you can't actually run this
154169
urlpatterns = [
155-
path("test-taint/<foo>/<bar>", test_taint), # $routeSetup="test-taint/<foo>/<bar>"
170+
path("test-taint/<foo>/<bar>", test_taint), # $ routeSetup="test-taint/<foo>/<bar>"
171+
path("ClassView/", ClassView.as_view()), # $ routeSetup="ClassView/"
156172
]

‎python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,5 @@ def post(self, request: HttpRequest): # $ requestHandler
3030

3131
class MyViewHandlerWithCustomInheritance(MyCustomViewBaseClass):
3232
def get(self, request: HttpRequest): # $ requestHandler
33+
print(self.request.GET)
3334
return HttpResponse("MyViewHandlerWithCustomInheritance: GET") # $ HttpResponse

0 commit comments

Comments
 (0)