Skip to content

Commit e2facd0

Browse files
RasmusWLRasmusWL
committed
Python: Expand cleartext query tests
1 parent 5506365 commit e2facd0

File tree

8 files changed

+68
-22
lines changed

8 files changed

+68
-22
lines changed

‎python/ql/test/query-tests/Security/CWE-312-CleartextLogging/CleartextLogging.expected

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
edges
2-
| test.py:7:16:7:29 | a password | test.py:8:35:8:42 | a password |
3-
| test.py:7:16:7:29 | a password | test.py:8:35:8:42 | a password |
2+
| test.py:19:16:19:29 | a password | test.py:20:48:20:55 | a password |
3+
| test.py:19:16:19:29 | a password | test.py:20:48:20:55 | a password |
44
#select
5-
| test.py:8:35:8:42 | password | test.py:7:16:7:29 | a password | test.py:8:35:8:42 | a password | Sensitive data returned by $@ is logged here. | test.py:7:16:7:29 | get_password() | a call returning a password |
6-
| test.py:14:30:14:39 | get_cert() | test.py:14:30:14:39 | a certificate or key | test.py:14:30:14:39 | a certificate or key | Sensitive data returned by $@ is logged here. | test.py:14:30:14:39 | get_cert() | a call returning a certificate or key |
7-
| test.py:17:11:17:24 | get_password() | test.py:17:11:17:24 | a password | test.py:17:11:17:24 | a password | Sensitive data returned by $@ is logged here. | test.py:17:11:17:24 | get_password() | a call returning a password |
5+
| test.py:20:48:20:55 | password | test.py:19:16:19:29 | a password | test.py:20:48:20:55 | a password | Sensitive data returned by $@ is logged here. | test.py:19:16:19:29 | get_password() | a call returning a password |
6+
| test.py:34:30:34:39 | get_cert() | test.py:34:30:34:39 | a certificate or key | test.py:34:30:34:39 | a certificate or key | Sensitive data returned by $@ is logged here. | test.py:34:30:34:39 | get_cert() | a call returning a certificate or key |
7+
| test.py:37:11:37:24 | get_password() | test.py:37:11:37:24 | a password | test.py:37:11:37:24 | a password | Sensitive data returned by $@ is logged here. | test.py:37:11:37:24 | get_password() | a call returning a password |

‎python/ql/test/query-tests/Security/CWE-312-CleartextLogging/test.py

Lines changed: 36 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,46 @@
1-
#Don't import logging; it transitively imports a lot of stuff
1+
import logging
2+
import sys
3+
4+
LOGGER = logging.getLogger("LOGGER")
5+
6+
def get_logger():
7+
return LOGGER
8+
29

310
def get_password():
4-
pass
11+
return "<PASSWORD>"
12+
13+
14+
def get_cert():
15+
return "<CERT>"
16+
517

618
def log_password():
719
password = get_password()
8-
logging.info("Password '%s'", password)
20+
logging.info("logging.info Password '%s'", password) # NOT OK
21+
22+
LOGGER.log(logging.INFO, "LOGGER.log Password '%s'", password) # NOT OK
23+
logging.root.info("logging.root.info Password '%s'", password) # NOT OK
24+
25+
# name of logger variable should not matter
26+
foo = LOGGER
27+
foo.info("foo.info Password '%s'", password) # NOT OK
28+
29+
# return value from function
30+
get_logger().info("get_logger().info Password '%s'", password) # NOT OK
931

10-
def get_cert():
11-
pass
1232

1333
def log_cert():
14-
logging.debug("Cert=%s", get_cert())
34+
logging.debug("Cert=%s", get_cert()) # NOT OK
1535

1636
def print_password():
17-
print(get_password())
37+
print(get_password()) # NOT OK
38+
39+
sys.stdout.write(get_password()) # NOT OK
40+
sys.stderr.write(get_password()) # NOT OK
41+
42+
if __name__ == "__main__":
43+
logging.basicConfig(level=logging.DEBUG)
44+
log_password()
45+
log_cert()
46+
print_password()

‎python/ql/test/query-tests/Security/CWE-312-CleartextStorage-py3/CleartextStorage.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
edges
2+
#select

‎python/ql/test/query-tests/Security/CWE-312-CleartextStorage-py3/CleartextStorage.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE-312/CleartextStorage.ql

‎python/ql/test/query-tests/Security/CWE-312-CleartextStorage-py3/options

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
semmle-extractor-options: --lang=3 -p ../lib/ --max-import-depth=3

‎python/ql/test/query-tests/Security/CWE-312-CleartextStorage-py3/test.py

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
import pathlib
2+
3+
4+
def get_cert():
5+
return "<CERT>"
6+
7+
8+
def write_password(filename):
9+
cert = get_cert()
10+
11+
path = pathlib.Path(filename)
12+
path.write_text(cert) # NOT OK
13+
path.write_bytes(cert.encode("utf-8")) # NOT OK
14+
15+
path.open("w").write(cert) # NOT OK

‎python/ql/test/query-tests/Security/CWE-312-CleartextStorage/CleartextStorage.expected

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@ edges
33
| password_in_cookie.py:7:16:7:43 | a password | password_in_cookie.py:9:33:9:40 | a password |
44
| password_in_cookie.py:14:16:14:43 | a password | password_in_cookie.py:16:33:16:40 | a password |
55
| password_in_cookie.py:14:16:14:43 | a password | password_in_cookie.py:16:33:16:40 | a password |
6-
| test.py:10:12:10:21 | a certificate or key | test.py:12:20:12:23 | a certificate or key |
7-
| test.py:10:12:10:21 | a certificate or key | test.py:12:20:12:23 | a certificate or key |
6+
| test.py:6:12:6:21 | a certificate or key | test.py:8:20:8:23 | a certificate or key |
7+
| test.py:6:12:6:21 | a certificate or key | test.py:8:20:8:23 | a certificate or key |
88
#select
99
| password_in_cookie.py:9:33:9:40 | password | password_in_cookie.py:7:16:7:43 | a password | password_in_cookie.py:9:33:9:40 | a password | Sensitive data from $@ is stored here. | password_in_cookie.py:7:16:7:43 | Attribute() | a request parameter containing a password |
1010
| password_in_cookie.py:16:33:16:40 | password | password_in_cookie.py:14:16:14:43 | a password | password_in_cookie.py:16:33:16:40 | a password | Sensitive data from $@ is stored here. | password_in_cookie.py:14:16:14:43 | Attribute() | a request parameter containing a password |
11-
| test.py:12:20:12:23 | cert | test.py:10:12:10:21 | a certificate or key | test.py:12:20:12:23 | a certificate or key | Sensitive data from $@ is stored here. | test.py:10:12:10:21 | get_cert() | a call returning a certificate or key |
11+
| test.py:8:20:8:23 | cert | test.py:6:12:6:21 | a certificate or key | test.py:8:20:8:23 | a certificate or key | Sensitive data from $@ is stored here. | test.py:6:12:6:21 | get_cert() | a call returning a certificate or key |

‎python/ql/test/query-tests/Security/CWE-312-CleartextStorage/test.py

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
1-
#Don't import logging; it transitively imports a lot of stuff
2-
3-
def get_password():
4-
pass
5-
61
def get_cert():
7-
pass
2+
return "<CERT>"
3+
84

95
def write_cert(filename):
106
cert = get_cert()
117
with open(filename, "w") as file:
12-
file.write(cert)
8+
file.write(cert) # NOT OK
9+
lines = [cert + "\n"]
10+
file.writelines(lines) # NOT OK

0 commit comments

Comments
 (0)