Python: django.http.response.HttpResponseRedirect

Rasmus Lerchedahl Petersen · Rasmus Lerchedahl Petersen · commit 08af839757d8 · 2020-10-30T01:29:49.000+01:00
diff --git a/python/ql/src/experimental/semmle/python/frameworks/Django.qll b/python/ql/src/experimental/semmle/python/frameworks/Django.qll
@@ -499,7 +499,13 @@ private module Django {
        * WARNING: Only holds for a few predefined attributes.
        */
       private DataFlow::Node http_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["request", "HttpRequest", "response", "HttpResponse", "JsonResponse"] and
+        attr_name in ["request",
+              // request
+              "HttpRequest",
+              // response
+              "response", "HttpResponse",
+              // HttpResponse subclasses
+              "HttpResponseRedirect", "JsonResponse"] and
         (
           t.start() and
           result = DataFlow::importNode("django.http" + "." + attr_name)
@@ -641,7 +647,7 @@ private module Django {
          * WARNING: Only holds for a few predefined attributes.
          */
         private DataFlow::Node response_attr(DataFlow::TypeTracker t, string attr_name) {
-          attr_name in ["HttpResponse", "JsonResponse"] and
+          attr_name in ["HttpResponse", "HttpResponseRedirect", "JsonResponse"] and
           (
             t.start() and
             result = DataFlow::importNode("django.http.response" + "." + attr_name)
@@ -742,7 +748,70 @@ private module Django {
 
         // ---------------------------------------------------------------------------
         // HttpResponse subclasses
+        // see https://docs.djangoproject.com/en/3.1/ref/request-response/#httpresponse-subclasses
         // ---------------------------------------------------------------------------
+        /**
+         * Provides models for the `django.http.response.HttpResponseRedirect` class
+         *
+         * See https://docs.djangoproject.com/en/3.1/ref/request-response/#django.http.HttpResponseRedirect.
+         */
+        module HttpResponseRedirect {
+          /** Gets a reference to the `django.http.response.HttpResponseRedirect` class. */
+          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
+            t.start() and
+            result = response_attr("HttpResponseRedirect")
+            or
+            // TODO: remove/expand this part of the template as needed
+            // Handle `http.HttpResponseRedirect` alias
+            t.start() and
+            result = http_attr("HttpResponseRedirect")
+            or
+            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+          }
+
+          /** Gets a reference to the `django.http.response.HttpResponseRedirect` class. */
+          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+
+          /**
+           * A source of an instance of `django.http.response.HttpResponseRedirect`.
+           *
+           * This can include instantiation of the class, return value from function
+           * calls, or a special parameter that will be set when functions are call by external
+           * library.
+           *
+           * Use `HttpResponseRedirect::instance()` predicate to get references to instances of `django.http.response.HttpResponseRedirect`.
+           */
+          abstract class InstanceSource extends HTTP::Server::HttpResponse::Range, DataFlow::Node {
+          }
+
+          /** A direct instantiation of `django.http.response.HttpResponseRedirect`. */
+          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
+            override CallNode node;
+
+            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+
+            override DataFlow::Node getBody() {
+              result.asCfgNode() in [node.getArg(0), node.getArgByName("content")]
+            }
+
+            // How to support the `headers` argument here?
+            override DataFlow::Node getMimetypeOrContentTypeArg() { none() }
+
+            override string getMimetypeDefault() { result = "text/html; charset=utf-8" }
+          }
+
+          /** Gets a reference to an instance of `django.http.response.HttpResponseRedirect`. */
+          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+            t.start() and
+            result instanceof InstanceSource
+            or
+            exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
+          }
+
+          /** Gets a reference to an instance of `django.http.response.HttpResponseRedirect`. */
+          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+        }
+
         /**
          * Provides models for the `django.http.response.JsonResponse` class
          *
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v1/response_test.py b/python/ql/test/experimental/library-tests/frameworks/django-v1/response_test.py
@@ -16,13 +16,14 @@ def safe__manual_content_type(request):
     return HttpResponse('<img src="0" onerror="alert(1)">', content_type="text/plain")  # $HttpResponse $mimetype=text/plain $responseBody='<img src="0" onerror="alert(1)">'
 
 # XSS FP reported in https://github.com/github/codeql/issues/3466
-# Note: This should be a open-redirect sink, but not a XSS sink.
+# Note: This should be an open-redirect sink, but not an XSS sink.
 def or__redirect(request):
-    return HttpResponseRedirect(request.GET.get("next"))  # f-:HttpResponse
+    return HttpResponseRedirect(request.GET.get("next"))  # $HttpResponse $mimetype=text/html; charset=utf-8 $responseBody=Attribute()
+
 # Ensure that simple subclasses are still vuln to XSS
 def xss__not_found(request):
-    return HttpResponseNotFound(request.GET.get("name"))  # f-:HttpResponse
+    return HttpResponseNotFound(request.GET.get("name"))  # $f-:HttpResponse
 
-# Ensure we still have a XSS sink when manually setting the content_type to HTML
+# Ensure we still have an XSS sink when manually setting the content_type to HTML
 def xss__manual_response_type(request):
     return HttpResponse(request.GET.get("name"), content_type="text/html; charset=utf-8")  # $HttpResponse $mimetype=text/html $responseBody=Attribute()
