Python: Add flask xss examples to flask tests

RasmusWL · RasmusWL · commit 3ad43f32b66c · 2019-11-12T10:36:10.000+01:00
diff --git a/python/ql/test/library-tests/web/flask/Routing.expected b/python/ql/test/library-tests/web/flask/Routing.expected
@@ -1,4 +1,6 @@
 | / | Function hello |
 | /dangerous | Function dangerous |
 | /dangerous-with-cfg-split | Function dangerous2 |
+| /safe | Function safe |
 | /the/ | Function get |
+| /unsafe | Function unsafe |
diff --git a/python/ql/test/library-tests/web/flask/Sinks.expected b/python/ql/test/library-tests/web/flask/Sinks.expected
@@ -2,3 +2,7 @@
 | test.py:29 | Attribute() | externally controlled string |
 | test.py:35 | Subscript | externally controlled string |
 | test.py:36 | None | externally controlled string |
+| test.py:41 | BinaryExpr | externally controlled string |
+| test.py:41 | make_response() | externally controlled string |
+| test.py:46 | BinaryExpr | externally controlled string |
+| test.py:46 | make_response() | externally controlled string |
diff --git a/python/ql/test/library-tests/web/flask/Sources.expected b/python/ql/test/library-tests/web/flask/Sources.expected
@@ -2,3 +2,5 @@
 | test.py:29 | Attribute | {externally controlled string} |
 | test.py:33 | Attribute | {externally controlled string} |
 | test.py:35 | Attribute | {externally controlled string} |
+| test.py:40 | Attribute | {externally controlled string} |
+| test.py:45 | Attribute | {externally controlled string} |
diff --git a/python/ql/test/library-tests/web/flask/Taint.expected b/python/ql/test/library-tests/web/flask/Taint.expected
@@ -6,3 +6,12 @@
 | test.py:33 | Subscript | externally controlled string |
 | test.py:35 | Attribute | {externally controlled string} |
 | test.py:35 | Subscript | externally controlled string |
+| test.py:40 | Attribute | {externally controlled string} |
+| test.py:40 | Attribute() | externally controlled string |
+| test.py:41 | BinaryExpr | externally controlled string |
+| test.py:41 | first_name | externally controlled string |
+| test.py:41 | make_response() | flask.Response |
+| test.py:45 | Attribute | {externally controlled string} |
+| test.py:45 | Attribute() | externally controlled string |
+| test.py:46 | first_name | externally controlled string |
+| test.py:46 | make_response() | flask.Response |
diff --git a/python/ql/test/library-tests/web/flask/test.py b/python/ql/test/library-tests/web/flask/test.py
@@ -1,6 +1,6 @@
 import flask
 
-from flask import Flask, request
+from flask import Flask, request, make_response
 app = Flask(__name__)
 
 @app.route("/")
@@ -34,3 +34,13 @@ def dangerous2():
     if request.method == "POST":
         return request.form['param1']
     return None
+
+@app.route('/unsafe')
+def unsafe():
+    first_name = request.args.get('name', '')
+    return make_response("Your name is " + first_name)
+
+@app.route('/safe')
+def safe():
+    first_name = request.args.get('name', '')
+    return make_response("Your name is " + escape(first_name))
