Python: Don't consider has_body tainted

RasmusWL · RasmusWL · commit 597a9dfc8005 · 2021-06-03T10:55:34.000+02:00
Although it technically is, I think it belong in the section of things
that are unlikely to be exploitable
diff --git a/python/ql/src/semmle/python/frameworks/Aiohttp.qll b/python/ql/src/semmle/python/frameworks/Aiohttp.qll
@@ -224,9 +224,8 @@ module AiohttpWebModel {
       nodeTo.(DataFlow::AttrRead).getObject() = nodeFrom and
       nodeTo.(DataFlow::AttrRead).getAttributeName() in [
           "url", "rel_url", "forwarded", "host", "remote", "path", "path_qs", "raw_path", "query",
-          "headers", "transport", "cookies", "content", "_payload", "body_exists", "has_body",
-          "content_type", "charset", "http_range", "if_modified_since", "if_unmodified_since",
-          "if_range"
+          "headers", "transport", "cookies", "content", "_payload", "content_type", "charset",
+          "http_range", "if_modified_since", "if_unmodified_since", "if_range"
         ]
     }
   }
diff --git a/python/ql/test/library-tests/frameworks/aiohttp/taint_test.py b/python/ql/test/library-tests/frameworks/aiohttp/taint_test.py
@@ -66,9 +66,6 @@ async def test_taint(request: web.Request): # $ requestHandler
         request.content, # $ tainted
         request._payload, # $ tainted
 
-        request.body_exists, # $ tainted
-        request.has_body, # $ tainted
-
         request.content_type, # $ tainted
         request.charset, # $ tainted
 
@@ -116,6 +113,9 @@ async def test_taint(request: web.Request): # $ requestHandler
         request.keep_alive,
 
         request.content_length,
+        request.body_exists,
+        request.has_body,
+        request.can_read_body,
     )
 
     ensure_not_tainted(

Original file line number	Diff line number	Diff line change
`@@ -224,9 +224,8 @@ module AiohttpWebModel {`
`224`	`224`	`nodeTo.(DataFlow::AttrRead).getObject() = nodeFrom and`
`225`	`225`	`nodeTo.(DataFlow::AttrRead).getAttributeName() in [`
`226`	`226`	`"url", "rel_url", "forwarded", "host", "remote", "path", "path_qs", "raw_path", "query",`
`227`		`- "headers", "transport", "cookies", "content", "_payload", "body_exists", "has_body",`
`228`		`- "content_type", "charset", "http_range", "if_modified_since", "if_unmodified_since",`
`229`		`- "if_range"`
	`227`	`+ "headers", "transport", "cookies", "content", "_payload", "content_type", "charset",`
	`228`	`+ "http_range", "if_modified_since", "if_unmodified_since", "if_range"`
`230`	`229`	`]`
`231`	`230`	`}`
`232`	`231`	`}`