Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 3c08590

Browse files
RasmusWLRasmusWL
committed
Python: Expand flask tests a bit
1 parent 2bdd028 commit 3c08590

2 files changed

Lines changed: 88 additions & 44 deletions

File tree

‎python/ql/test/experimental/library-tests/frameworks/flask/TestTaint.expected‎

Lines changed: 56 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -38,47 +38,59 @@
3838
| test.py:70 | fail | test_taint | request.files['key'].filename |
3939
| test.py:71 | fail | test_taint | request.files['key'].stream |
4040
| test.py:72 | fail | test_taint | request.files.getlist(..) |
41-
| test.py:75 | ok | test_taint | request.form |
42-
| test.py:76 | ok | test_taint | request.form['key'] |
43-
| test.py:77 | ok | test_taint | request.form.getlist(..) |
44-
| test.py:79 | ok | test_taint | request.get_data() |
45-
| test.py:81 | ok | test_taint | request.get_json() |
46-
| test.py:82 | ok | test_taint | request.get_json()['foo'] |
47-
| test.py:83 | ok | test_taint | request.get_json()['foo']['bar'] |
48-
| test.py:87 | ok | test_taint | request.headers |
49-
| test.py:88 | ok | test_taint | request.headers['key'] |
50-
| test.py:89 | fail | test_taint | request.headers.get_all(..) |
51-
| test.py:90 | fail | test_taint | request.headers.getlist(..) |
52-
| test.py:91 | ok | test_taint | list(..) |
53-
| test.py:92 | fail | test_taint | request.headers.to_wsgi_list() |
54-
| test.py:94 | ok | test_taint | request.json |
55-
| test.py:95 | ok | test_taint | request.json['foo'] |
56-
| test.py:96 | ok | test_taint | request.json['foo']['bar'] |
57-
| test.py:98 | ok | test_taint | request.method |
58-
| test.py:100 | ok | test_taint | request.mimetype |
59-
| test.py:102 | ok | test_taint | request.mimetype_params |
60-
| test.py:104 | ok | test_taint | request.origin |
61-
| test.py:107 | ok | test_taint | request.pragma |
62-
| test.py:109 | ok | test_taint | request.query_string |
63-
| test.py:111 | ok | test_taint | request.referrer |
64-
| test.py:113 | ok | test_taint | request.remote_addr |
65-
| test.py:115 | ok | test_taint | request.remote_user |
66-
| test.py:118 | ok | test_taint | request.stream |
67-
| test.py:119 | ok | test_taint | request.input_stream |
68-
| test.py:121 | ok | test_taint | request.url |
69-
| test.py:123 | ok | test_taint | request.user_agent |
70-
| test.py:126 | ok | test_taint | request.values |
71-
| test.py:127 | ok | test_taint | request.values['key'] |
72-
| test.py:128 | ok | test_taint | request.values.getlist(..) |
73-
| test.py:131 | ok | test_taint | request.view_args |
74-
| test.py:132 | ok | test_taint | request.view_args['key'] |
75-
| test.py:136 | ok | test_taint | request.script_root |
76-
| test.py:137 | ok | test_taint | request.url_root |
77-
| test.py:141 | ok | test_taint | request.charset |
78-
| test.py:142 | ok | test_taint | request.url_charset |
79-
| test.py:146 | ok | test_taint | request.date |
80-
| test.py:149 | ok | test_taint | request.endpoint |
81-
| test.py:154 | ok | test_taint | request.host |
82-
| test.py:155 | ok | test_taint | request.host_url |
83-
| test.py:157 | ok | test_taint | request.scheme |
84-
| test.py:159 | ok | test_taint | request.script_root |
41+
| test.py:73 | fail | test_taint | request.files.getlist(..)[0].filename |
42+
| test.py:74 | fail | test_taint | request.files.getlist(..)[0].stream |
43+
| test.py:77 | ok | test_taint | request.form |
44+
| test.py:78 | ok | test_taint | request.form['key'] |
45+
| test.py:79 | ok | test_taint | request.form.getlist(..) |
46+
| test.py:81 | ok | test_taint | request.get_data() |
47+
| test.py:83 | ok | test_taint | request.get_json() |
48+
| test.py:84 | ok | test_taint | request.get_json()['foo'] |
49+
| test.py:85 | ok | test_taint | request.get_json()['foo']['bar'] |
50+
| test.py:89 | ok | test_taint | request.headers |
51+
| test.py:90 | ok | test_taint | request.headers['key'] |
52+
| test.py:91 | fail | test_taint | request.headers.get_all(..) |
53+
| test.py:92 | fail | test_taint | request.headers.getlist(..) |
54+
| test.py:93 | ok | test_taint | list(..) |
55+
| test.py:94 | fail | test_taint | request.headers.to_wsgi_list() |
56+
| test.py:96 | ok | test_taint | request.json |
57+
| test.py:97 | ok | test_taint | request.json['foo'] |
58+
| test.py:98 | ok | test_taint | request.json['foo']['bar'] |
59+
| test.py:100 | ok | test_taint | request.method |
60+
| test.py:102 | ok | test_taint | request.mimetype |
61+
| test.py:104 | ok | test_taint | request.mimetype_params |
62+
| test.py:106 | ok | test_taint | request.origin |
63+
| test.py:109 | ok | test_taint | request.pragma |
64+
| test.py:111 | ok | test_taint | request.query_string |
65+
| test.py:113 | ok | test_taint | request.referrer |
66+
| test.py:115 | ok | test_taint | request.remote_addr |
67+
| test.py:117 | ok | test_taint | request.remote_user |
68+
| test.py:120 | ok | test_taint | request.stream |
69+
| test.py:121 | ok | test_taint | request.input_stream |
70+
| test.py:123 | ok | test_taint | request.url |
71+
| test.py:125 | ok | test_taint | request.user_agent |
72+
| test.py:128 | ok | test_taint | request.values |
73+
| test.py:129 | ok | test_taint | request.values['key'] |
74+
| test.py:130 | ok | test_taint | request.values.getlist(..) |
75+
| test.py:133 | ok | test_taint | request.view_args |
76+
| test.py:134 | ok | test_taint | request.view_args['key'] |
77+
| test.py:138 | ok | test_taint | request.script_root |
78+
| test.py:139 | ok | test_taint | request.url_root |
79+
| test.py:143 | ok | test_taint | request.charset |
80+
| test.py:144 | ok | test_taint | request.url_charset |
81+
| test.py:148 | ok | test_taint | request.date |
82+
| test.py:151 | ok | test_taint | request.endpoint |
83+
| test.py:156 | ok | test_taint | request.host |
84+
| test.py:157 | ok | test_taint | request.host_url |
85+
| test.py:159 | ok | test_taint | request.scheme |
86+
| test.py:161 | ok | test_taint | request.script_root |
87+
| test.py:169 | ok | test_taint | request.args |
88+
| test.py:170 | ok | test_taint | a |
89+
| test.py:171 | ok | test_taint | b |
90+
| test.py:173 | ok | test_taint | request.args['key'] |
91+
| test.py:174 | ok | test_taint | a['key'] |
92+
| test.py:175 | ok | test_taint | b['key'] |
93+
| test.py:177 | ok | test_taint | request.args.getlist(..) |
94+
| test.py:178 | ok | test_taint | a.getlist(..) |
95+
| test.py:179 | ok | test_taint | b.getlist(..) |
96+
| test.py:180 | fail | test_taint | gl(..) |

‎python/ql/test/experimental/library-tests/frameworks/flask/test.py‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,8 @@ def test_taint(name = "World!", number="0", foo="foo"):
7070
request.files['key'].filename,
7171
request.files['key'].stream,
7272
request.files.getlist('key'),
73+
request.files.getlist('key')[0].filename,
74+
request.files.getlist('key')[0].stream,
7375

7476
# By default werkzeug.datastructures.ImmutableMultiDict -- although can be changed :\
7577
request.form,
@@ -159,6 +161,27 @@ def test_taint(name = "World!", number="0", foo="foo"):
159161
request.script_root,
160162
)
161163

164+
# Testing some more tricky data-flow still works
165+
a = request.args
166+
b = a
167+
gl = b.getlist
168+
ensure_tainted(
169+
request.args,
170+
a,
171+
b,
172+
173+
request.args['key'],
174+
a['key'],
175+
b['key'],
176+
177+
request.args.getlist('key'),
178+
a.getlist('key'),
179+
b.getlist('key'),
180+
gl('key'),
181+
)
182+
183+
184+
162185

163186
@app.route('/debug/<foo>/<bar>', methods=['GET'])
164187
def debug(foo, bar):
@@ -216,6 +239,13 @@ def file_upload():
216239

217240
return 'ok'
218241

242+
@app.route('/args', methods=['GET'])
243+
def args():
244+
print(request.path)
245+
print("request.args", request.args)
246+
247+
return 'ok'
248+
219249
# curl --header "My-Header: some-value" http://localhost:5000/debug/fooval/barval
220250
# curl --header "Pragma: foo, bar" --header "Pragma: stuff, foo" http://localhost:5000/debug/fooval/barval
221251

@@ -229,5 +259,7 @@ def file_upload():
229259

230260
# curl -F myfile=@<some-file> localhost:5000/file_upload
231261

262+
# curl http://localhost:5000/args?foo=42&bar=bar
263+
232264
if __name__ == "__main__":
233265
app.run(debug=True)

0 commit comments

Comments
 (0)