So I'm pretty sure this should be solved with the blackbox mapping

(venv) Kevins-MacBook-Pro:pyt kevin$ python -m pyt -f foo.py -i
/usr/local/Cellar/python3/3.6.1/Frameworks/Python.framework/Versions/3.6/lib/python3.6/runpy.py:125: RuntimeWarning: 'pyt.__main__' found in sys.modules after import of package 'pyt', but prior to execution of 'pyt.__main__'; this may result in unpredictable behaviour
  warn(RuntimeWarning(msg))
Is the return value of ~call_2 = ret_Post.query.paginate(page, per_page=current_app.config['FLASKY_POSTS_PER_PAGE'], error_out=False) with tainted argument "page" vulnerable? (Y/n)n
2 vulnerabilities found:
Vulnerability 1:
File: foo.py
 > User input at line 3, trigger word "request.args.get(":
	 ~call_1 = ret_request.args.get('page', 1, type=int)
Reassigned in:
	File: foo.py
	 > Line 3: page = ~call_1
File: foo.py
 > reaches line 9, trigger word "url_for(":
	~call_3 = ret_url_for('api.get_posts', page=page - 1, _external=True)

Vulnerability 2:
File: foo.py
 > User input at line 3, trigger word "request.args.get(":
	 ~call_1 = ret_request.args.get('page', 1, type=int)
Reassigned in:
	File: foo.py
	 > Line 3: page = ~call_1
File: foo.py
 > reaches line 12, trigger word "url_for(":
	~call_4 = ret_url_for('api.get_posts', page=page + 1, _external=True)

(venv) Kevins-MacBook-Pro:pyt kevin$ git status
On branch check_travis
Changes not staged for commit:
  (use "git add <file>..." to update what will be committed)
  (use "git checkout -- <file>..." to discard changes in working directory)

	modified:   foo.py
	modified:   pyt/vulnerability_definitions/blackbox_mapping.json

no changes added to commit (use "git add" and/or "git commit -a")
(venv) Kevins-MacBook-Pro:pyt kevin$ git diff pyt/vulnerability_definitions/blackbox_mapping.json
diff --git a/pyt/vulnerability_definitions/blackbox_mapping.json b/pyt/vulnerability_definitions/blackbox_mapping.json
index fbb229e..124e0d4 100644
--- a/pyt/vulnerability_definitions/blackbox_mapping.json
+++ b/pyt/vulnerability_definitions/blackbox_mapping.json
@@ -1,7 +1,8 @@
 {
     "does_not_propagate": [
         "fast_eddie",
-        "url_for"
+        "url_for",
+        "Post.query.paginate"
     ],
     "propagates": [
         "os.path.join",
(venv) Kevins-MacBook-Pro:pyt kevin$

Pagination vulnerabilities #11

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions