Skip to content

Commit b359205

Browse files
RasmusWLRasmusWL
committed
Python: Add taint tests for .get() in flask
1 parent 972cc47 commit b359205

File tree

2 files changed

+93
-77
lines changed

2 files changed

+93
-77
lines changed

‎python/ql/test/library-tests/frameworks/flask/TestTaint.expected

Lines changed: 85 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -19,80 +19,88 @@
1919
| taint_test.py:36 | ok | test_taint | request.access_route[0] |
2020
| taint_test.py:39 | ok | test_taint | request.args |
2121
| taint_test.py:40 | ok | test_taint | request.args['key'] |
22-
| taint_test.py:41 | ok | test_taint | request.args.getlist(..) |
23-
| taint_test.py:44 | ok | test_taint | request.authorization |
24-
| taint_test.py:45 | ok | test_taint | request.authorization['username'] |
25-
| taint_test.py:46 | fail | test_taint | request.authorization.username |
26-
| taint_test.py:49 | ok | test_taint | request.cache_control |
27-
| taint_test.py:51 | fail | test_taint | request.cache_control.max_age |
28-
| taint_test.py:52 | fail | test_taint | request.cache_control.max_stale |
29-
| taint_test.py:53 | fail | test_taint | request.cache_control.min_fresh |
30-
| taint_test.py:55 | ok | test_taint | request.content_encoding |
31-
| taint_test.py:57 | ok | test_taint | request.content_md5 |
32-
| taint_test.py:59 | ok | test_taint | request.content_type |
33-
| taint_test.py:62 | ok | test_taint | request.cookies |
34-
| taint_test.py:63 | ok | test_taint | request.cookies['key'] |
35-
| taint_test.py:65 | ok | test_taint | request.data |
36-
| taint_test.py:68 | ok | test_taint | request.files |
37-
| taint_test.py:69 | ok | test_taint | request.files['key'] |
38-
| taint_test.py:70 | fail | test_taint | request.files['key'].filename |
39-
| taint_test.py:71 | fail | test_taint | request.files['key'].stream |
40-
| taint_test.py:72 | ok | test_taint | request.files.getlist(..) |
41-
| taint_test.py:73 | fail | test_taint | request.files.getlist(..)[0].filename |
42-
| taint_test.py:74 | fail | test_taint | request.files.getlist(..)[0].stream |
43-
| taint_test.py:77 | ok | test_taint | request.form |
44-
| taint_test.py:78 | ok | test_taint | request.form['key'] |
45-
| taint_test.py:79 | ok | test_taint | request.form.getlist(..) |
46-
| taint_test.py:81 | ok | test_taint | request.get_data() |
47-
| taint_test.py:83 | ok | test_taint | request.get_json() |
48-
| taint_test.py:84 | ok | test_taint | request.get_json()['foo'] |
49-
| taint_test.py:85 | ok | test_taint | request.get_json()['foo']['bar'] |
50-
| taint_test.py:89 | ok | test_taint | request.headers |
51-
| taint_test.py:90 | ok | test_taint | request.headers['key'] |
52-
| taint_test.py:91 | fail | test_taint | request.headers.get_all(..) |
53-
| taint_test.py:92 | fail | test_taint | request.headers.getlist(..) |
54-
| taint_test.py:93 | ok | test_taint | list(..) |
55-
| taint_test.py:94 | fail | test_taint | request.headers.to_wsgi_list() |
56-
| taint_test.py:96 | ok | test_taint | request.json |
57-
| taint_test.py:97 | ok | test_taint | request.json['foo'] |
58-
| taint_test.py:98 | ok | test_taint | request.json['foo']['bar'] |
59-
| taint_test.py:100 | ok | test_taint | request.method |
60-
| taint_test.py:102 | ok | test_taint | request.mimetype |
61-
| taint_test.py:104 | ok | test_taint | request.mimetype_params |
62-
| taint_test.py:106 | ok | test_taint | request.origin |
63-
| taint_test.py:109 | ok | test_taint | request.pragma |
64-
| taint_test.py:111 | ok | test_taint | request.query_string |
65-
| taint_test.py:113 | ok | test_taint | request.referrer |
66-
| taint_test.py:115 | ok | test_taint | request.remote_addr |
67-
| taint_test.py:117 | ok | test_taint | request.remote_user |
68-
| taint_test.py:120 | ok | test_taint | request.stream |
69-
| taint_test.py:121 | ok | test_taint | request.input_stream |
70-
| taint_test.py:123 | ok | test_taint | request.url |
71-
| taint_test.py:125 | ok | test_taint | request.user_agent |
72-
| taint_test.py:128 | ok | test_taint | request.values |
73-
| taint_test.py:129 | ok | test_taint | request.values['key'] |
74-
| taint_test.py:130 | ok | test_taint | request.values.getlist(..) |
75-
| taint_test.py:133 | ok | test_taint | request.view_args |
76-
| taint_test.py:134 | ok | test_taint | request.view_args['key'] |
77-
| taint_test.py:138 | ok | test_taint | request.script_root |
78-
| taint_test.py:139 | ok | test_taint | request.url_root |
79-
| taint_test.py:143 | ok | test_taint | request.charset |
80-
| taint_test.py:144 | ok | test_taint | request.url_charset |
81-
| taint_test.py:148 | ok | test_taint | request.date |
82-
| taint_test.py:151 | ok | test_taint | request.endpoint |
83-
| taint_test.py:156 | ok | test_taint | request.host |
84-
| taint_test.py:157 | ok | test_taint | request.host_url |
85-
| taint_test.py:159 | ok | test_taint | request.scheme |
86-
| taint_test.py:161 | ok | test_taint | request.script_root |
87-
| taint_test.py:169 | ok | test_taint | request.args |
88-
| taint_test.py:170 | ok | test_taint | a |
89-
| taint_test.py:171 | ok | test_taint | b |
90-
| taint_test.py:173 | ok | test_taint | request.args['key'] |
91-
| taint_test.py:174 | ok | test_taint | a['key'] |
92-
| taint_test.py:175 | ok | test_taint | b['key'] |
93-
| taint_test.py:177 | ok | test_taint | request.args.getlist(..) |
94-
| taint_test.py:178 | ok | test_taint | a.getlist(..) |
95-
| taint_test.py:179 | ok | test_taint | b.getlist(..) |
96-
| taint_test.py:180 | ok | test_taint | gl(..) |
97-
| taint_test.py:187 | ok | test_taint | req.path |
98-
| taint_test.py:188 | ok | test_taint | gd() |
22+
| taint_test.py:41 | ok | test_taint | request.args.get(..) |
23+
| taint_test.py:42 | ok | test_taint | request.args.getlist(..) |
24+
| taint_test.py:45 | ok | test_taint | request.authorization |
25+
| taint_test.py:46 | ok | test_taint | request.authorization['username'] |
26+
| taint_test.py:47 | fail | test_taint | request.authorization.username |
27+
| taint_test.py:50 | ok | test_taint | request.cache_control |
28+
| taint_test.py:52 | fail | test_taint | request.cache_control.max_age |
29+
| taint_test.py:53 | fail | test_taint | request.cache_control.max_stale |
30+
| taint_test.py:54 | fail | test_taint | request.cache_control.min_fresh |
31+
| taint_test.py:56 | ok | test_taint | request.content_encoding |
32+
| taint_test.py:58 | ok | test_taint | request.content_md5 |
33+
| taint_test.py:60 | ok | test_taint | request.content_type |
34+
| taint_test.py:63 | ok | test_taint | request.cookies |
35+
| taint_test.py:64 | ok | test_taint | request.cookies['key'] |
36+
| taint_test.py:66 | ok | test_taint | request.data |
37+
| taint_test.py:69 | ok | test_taint | request.files |
38+
| taint_test.py:70 | ok | test_taint | request.files['key'] |
39+
| taint_test.py:71 | fail | test_taint | request.files['key'].filename |
40+
| taint_test.py:72 | fail | test_taint | request.files['key'].stream |
41+
| taint_test.py:73 | ok | test_taint | request.files.get(..) |
42+
| taint_test.py:74 | fail | test_taint | request.files.get(..).filename |
43+
| taint_test.py:75 | fail | test_taint | request.files.get(..).stream |
44+
| taint_test.py:76 | ok | test_taint | request.files.getlist(..) |
45+
| taint_test.py:77 | fail | test_taint | request.files.getlist(..)[0].filename |
46+
| taint_test.py:78 | fail | test_taint | request.files.getlist(..)[0].stream |
47+
| taint_test.py:81 | ok | test_taint | request.form |
48+
| taint_test.py:82 | ok | test_taint | request.form['key'] |
49+
| taint_test.py:83 | ok | test_taint | request.form.get(..) |
50+
| taint_test.py:84 | ok | test_taint | request.form.getlist(..) |
51+
| taint_test.py:86 | ok | test_taint | request.get_data() |
52+
| taint_test.py:88 | ok | test_taint | request.get_json() |
53+
| taint_test.py:89 | ok | test_taint | request.get_json()['foo'] |
54+
| taint_test.py:90 | ok | test_taint | request.get_json()['foo']['bar'] |
55+
| taint_test.py:94 | ok | test_taint | request.headers |
56+
| taint_test.py:95 | ok | test_taint | request.headers['key'] |
57+
| taint_test.py:96 | ok | test_taint | request.headers.get(..) |
58+
| taint_test.py:97 | fail | test_taint | request.headers.get_all(..) |
59+
| taint_test.py:98 | fail | test_taint | request.headers.getlist(..) |
60+
| taint_test.py:99 | ok | test_taint | list(..) |
61+
| taint_test.py:100 | fail | test_taint | request.headers.to_wsgi_list() |
62+
| taint_test.py:102 | ok | test_taint | request.json |
63+
| taint_test.py:103 | ok | test_taint | request.json['foo'] |
64+
| taint_test.py:104 | ok | test_taint | request.json['foo']['bar'] |
65+
| taint_test.py:106 | ok | test_taint | request.method |
66+
| taint_test.py:108 | ok | test_taint | request.mimetype |
67+
| taint_test.py:110 | ok | test_taint | request.mimetype_params |
68+
| taint_test.py:112 | ok | test_taint | request.origin |
69+
| taint_test.py:115 | ok | test_taint | request.pragma |
70+
| taint_test.py:117 | ok | test_taint | request.query_string |
71+
| taint_test.py:119 | ok | test_taint | request.referrer |
72+
| taint_test.py:121 | ok | test_taint | request.remote_addr |
73+
| taint_test.py:123 | ok | test_taint | request.remote_user |
74+
| taint_test.py:126 | ok | test_taint | request.stream |
75+
| taint_test.py:127 | ok | test_taint | request.input_stream |
76+
| taint_test.py:129 | ok | test_taint | request.url |
77+
| taint_test.py:131 | ok | test_taint | request.user_agent |
78+
| taint_test.py:134 | ok | test_taint | request.values |
79+
| taint_test.py:135 | ok | test_taint | request.values['key'] |
80+
| taint_test.py:136 | ok | test_taint | request.values.get(..) |
81+
| taint_test.py:137 | ok | test_taint | request.values.getlist(..) |
82+
| taint_test.py:140 | ok | test_taint | request.view_args |
83+
| taint_test.py:141 | ok | test_taint | request.view_args['key'] |
84+
| taint_test.py:142 | ok | test_taint | request.view_args.get(..) |
85+
| taint_test.py:146 | ok | test_taint | request.script_root |
86+
| taint_test.py:147 | ok | test_taint | request.url_root |
87+
| taint_test.py:151 | ok | test_taint | request.charset |
88+
| taint_test.py:152 | ok | test_taint | request.url_charset |
89+
| taint_test.py:156 | ok | test_taint | request.date |
90+
| taint_test.py:159 | ok | test_taint | request.endpoint |
91+
| taint_test.py:164 | ok | test_taint | request.host |
92+
| taint_test.py:165 | ok | test_taint | request.host_url |
93+
| taint_test.py:167 | ok | test_taint | request.scheme |
94+
| taint_test.py:169 | ok | test_taint | request.script_root |
95+
| taint_test.py:177 | ok | test_taint | request.args |
96+
| taint_test.py:178 | ok | test_taint | a |
97+
| taint_test.py:179 | ok | test_taint | b |
98+
| taint_test.py:181 | ok | test_taint | request.args['key'] |
99+
| taint_test.py:182 | ok | test_taint | a['key'] |
100+
| taint_test.py:183 | ok | test_taint | b['key'] |
101+
| taint_test.py:185 | ok | test_taint | request.args.getlist(..) |
102+
| taint_test.py:186 | ok | test_taint | a.getlist(..) |
103+
| taint_test.py:187 | ok | test_taint | b.getlist(..) |
104+
| taint_test.py:188 | ok | test_taint | gl(..) |
105+
| taint_test.py:195 | ok | test_taint | req.path |
106+
| taint_test.py:196 | ok | test_taint | gd() |

‎python/ql/test/library-tests/frameworks/flask/taint_test.py

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ def test_taint(name = "World!", number="0", foo="foo"): # $requestHandler route
3838
# By default werkzeug.datastructures.ImmutableMultiDict -- although can be changed :\
3939
request.args,
4040
request.args['key'],
41+
request.args.get('key'),
4142
request.args.getlist('key'),
4243

4344
# werkzeug.datastructures.Authorization (a dict, with some properties)
@@ -69,13 +70,17 @@ def test_taint(name = "World!", number="0", foo="foo"): # $requestHandler route
6970
request.files['key'],
7071
request.files['key'].filename,
7172
request.files['key'].stream,
73+
request.files.get('key'),
74+
request.files.get('key').filename,
75+
request.files.get('key').stream,
7276
request.files.getlist('key'),
7377
request.files.getlist('key')[0].filename,
7478
request.files.getlist('key')[0].stream,
7579

7680
# By default werkzeug.datastructures.ImmutableMultiDict -- although can be changed :\
7781
request.form,
7882
request.form['key'],
83+
request.form.get('key'),
7984
request.form.getlist('key'),
8085

8186
request.get_data(),
@@ -88,6 +93,7 @@ def test_taint(name = "World!", number="0", foo="foo"): # $requestHandler route
8893
# which has same interface as werkzeug.datastructures.Headers
8994
request.headers,
9095
request.headers['key'],
96+
request.headers.get('key'),
9197
request.headers.get_all('key'),
9298
request.headers.getlist('key'),
9399
list(request.headers), # (k, v) list
@@ -127,11 +133,13 @@ def test_taint(name = "World!", number="0", foo="foo"): # $requestHandler route
127133
# werkzeug.datastructures.CombinedMultiDict, which is basically just a werkzeug.datastructures.MultiDict
128134
request.values,
129135
request.values['key'],
136+
request.values.get('key'),
130137
request.values.getlist('key'),
131138

132139
# dict
133140
request.view_args,
134141
request.view_args['key'],
142+
request.view_args.get('key'),
135143
)
136144

137145
ensure_not_tainted(

0 commit comments

Comments
 (0)