Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 10b36bb

Browse files
RasmusWLRasmusWL
committed
Python: Taint of string method reference isn't handled
1 parent 243dea7 commit 10b36bb

3 files changed

Lines changed: 16 additions & 0 deletions

File tree

‎python/ql/test/library-tests/taint/strings/TestStep.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,10 @@
6262
| Taint externally controlled string | test.py:66 | test.py:66:22:66:35 | TAINTED_STRING | | --> | Taint externally controlled string | test.py:68 | test.py:68:29:68:42 | tainted_string | |
6363
| Taint externally controlled string | test.py:67 | test.py:67:29:67:42 | tainted_string | | --> | Taint [externally controlled string] | test.py:67 | test.py:67:20:67:43 | urlsplit() | |
6464
| Taint externally controlled string | test.py:68 | test.py:68:29:68:42 | tainted_string | | --> | Taint [externally controlled string] | test.py:68 | test.py:68:20:68:43 | urlparse() | |
65+
| Taint externally controlled string | test.py:72 | test.py:72:22:72:35 | TAINTED_STRING | | --> | Taint externally controlled string | test.py:74 | test.py:74:9:74:22 | tainted_string | |
66+
| Taint externally controlled string | test.py:72 | test.py:72:22:72:35 | TAINTED_STRING | | --> | Taint externally controlled string | test.py:76 | test.py:76:12:76:25 | tainted_string | |
67+
| Taint externally controlled string | test.py:74 | test.py:74:9:74:22 | tainted_string | | --> | Taint externally controlled string | test.py:74 | test.py:74:9:74:30 | Attribute() | |
68+
| Taint externally controlled string | test.py:74 | test.py:74:9:74:30 | Attribute() | | --> | Taint externally controlled string | test.py:79 | test.py:79:10:79:10 | a | |
6569
| Taint json[externally controlled string] | test.py:6 | test.py:6:20:6:45 | Attribute() | | --> | Taint json[externally controlled string] | test.py:7 | test.py:7:9:7:20 | tainted_json | |
6670
| Taint json[externally controlled string] | test.py:7 | test.py:7:9:7:20 | tainted_json | | --> | Taint externally controlled string | test.py:7 | test.py:7:9:7:25 | Subscript | |
6771
| Taint json[externally controlled string] | test.py:7 | test.py:7:9:7:20 | tainted_json | | --> | Taint json[externally controlled string] | test.py:7 | test.py:7:9:7:25 | Subscript | |

‎python/ql/test/library-tests/taint/strings/TestTaint.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,5 @@
2222
| test.py:58 | test_untrusted | res | externally controlled string |
2323
| test.py:69 | test_urlsplit_urlparse | urlparse_res | [externally controlled string] |
2424
| test.py:69 | test_urlsplit_urlparse | urlsplit_res | [externally controlled string] |
25+
| test.py:79 | test_method_reference | a | externally controlled string |
26+
| test.py:79 | test_method_reference | b | NO TAINT |

‎python/ql/test/library-tests/taint/strings/test.py‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,3 +67,13 @@ def test_urlsplit_urlparse():
6767
urlsplit_res = urlsplit(tainted_string)
6868
urlparse_res = urlparse(tainted_string)
6969
test(urlsplit_res, urlparse_res)
70+
71+
def test_method_reference():
72+
tainted_string = TAINTED_STRING
73+
74+
a = tainted_string.title()
75+
76+
func = tainted_string.title
77+
b = func()
78+
79+
test(a, b) # TODO: `b` not tainted

0 commit comments

Comments
 (0)