Python: Fixup tests

But notice that keyword argument is not handled yet

Author: RasmusWL

python/ql/test/library-tests/frameworks/aiohttp/response_test.py

@@ -25,10 +25,7 @@ async def html_body(request): # $ requestHandler
 
 @routes.get("/html_body_header") # $ routeSetup="/html_body_header"
 async def html_body_header(request): # $ requestHandler
-    return web.Response(
-        headers={"content-type": "text/html"},
-        text="<script>window.close()</script>Success! This window can be closed",
-    )
+    return web.Response(headers={"content-type": "text/html"}, text="foo") # $ HttpResponse mimetype=text/html responseBody="foo"
 
 @routes.get("/html_body_set_later") # $ routeSetup="/html_body_set_later"
 async def html_body_set_later(request): # $ requestHandler
@@ -71,10 +68,13 @@ async def redirect_302(request): # $ requestHandler
     else:
         raise web.HTTPFound(location="/logout") # $ HttpResponse HttpRedirectResponse mimetype=application/octet-stream redirectLocation="/logout"
 
-@routes.get("/serve_file") # $ routeSetup="/serve_file"
-async def serve_file(request): # $ requestHandler
-    filename = request.query.getone("filename"),
-    return web.FileResponse(filename) # $ HttpResponse mimetype=application/octet-stream
+
+@routes.get("/file_response") # $ routeSetup="/file_response"
+async def file_response(request): # $ requestHandler
+    filename = "foo.txt"
+    resp = web.FileResponse(filename) # $ HttpResponse mimetype=application/octet-stream getAPathArgument=filename
+    resp = web.FileResponse(path=filename) # $ HttpResponse mimetype=application/octet-stream MISSING: getAPathArgument=filename
+    return resp
 
 ################################################################################
 # Cookies

python/ql/test/library-tests/frameworks/aiohttp/taint_test.py

@@ -1,134 +1,5 @@
 from aiohttp import web
 
-async def test_heuristic_taint(request: web.Request):
-    ensure_tainted(
-        # see https://docs.aiohttp.org/en/stable/web_reference.html#request-and-base-request
-        request, # $ tainted
-
-        # yarl.URL (see `yarl` framework tests)
-        request.url, # $ tainted
-        request.url.human_repr(), # $ tainted
-        request.rel_url, # $ tainted
-        request.rel_url.human_repr(), # $ tainted
-
-        request.forwarded, # $ tainted
-
-        request.host, # $ tainted
-        request.remote, # $ tainted
-        request.path, # $ tainted
-        request.path_qs, # $ tainted
-        request.raw_path, # $ tainted
-
-        # dict-like for captured parts of the URL
-        request.match_info, # $ tainted
-        request.match_info["key"], # $ tainted
-        request.match_info.get("key"), # $ tainted
-
-        # multidict.MultiDictProxy[str] (see `multidict` framework tests)
-        request.query, # $ tainted
-        request.query.getone("key"), # $ tainted
-
-        # multidict.CIMultiDictProxy[str] (see `multidict` framework tests)
-        request.headers, # $ tainted
-        request.headers.getone("key"), # $ tainted
-
-
-
-        # dict-like (readonly)
-        request.cookies, # $ tainted
-        request.cookies["key"], # $ tainted
-        request.cookies.get("key"), # $ tainted
-        request.cookies.keys(), # $ tainted
-        request.cookies.values(), # $ tainted
-        request.cookies.items(), # $ tainted
-        list(request.cookies), # $ tainted
-        iter(request.cookies), # $ tainted
-
-
-        # aiohttp.StreamReader
-        # see https://docs.aiohttp.org/en/stable/streams.html#aiohttp.StreamReader
-        request.content, # $ tainted
-        await request.content.read(), # $ tainted
-        await request.content.readany(), # $ tainted
-        await request.content.readexactly(42), # $ tainted
-        await request.content.readline(), # $ tainted
-        await request.content.readchunk(), # $ tainted
-        (await request.content.readchunk())[0], # $ tainted
-        [line async for line in request.content], # $ tainted
-        [data async for data in request.content.iter_chunked(1024)], # $ tainted
-        [data async for data in request.content.iter_any()], # $ tainted
-        [data async for data, _ in request.content.iter_chunks()], # $ tainted
-        request.content.read_nowait(), # $ tainted
-
-        # aiohttp.StreamReader
-        request._payload, # $ tainted
-        await request._payload.readany(), # $ tainted
-
-        request.content_type, # $ tainted
-        request.charset, # $ tainted
-
-        request.http_range, # $ tainted
-
-        # Optional[datetime]
-        request.if_modified_since, # $ tainted
-        request.if_unmodified_since, # $ tainted
-        request.if_range, # $ tainted
-
-        request.clone(scheme="https"), # $ tainted
-
-        # asyncio.Transport
-        # https://docs.python.org/3/library/asyncio-protocol.html#asyncio-transport
-        # example given in https://docs.aiohttp.org/en/stable/web_reference.html#aiohttp.web.BaseRequest.transport
-        # uses `peername` to get IP address of client
-        request.transport, # $ tainted
-        request.transport.get_extra_info("key"), # $ MISSING: tainted
-
-        # Like request.transport.get_extra_info
-        request.get_extra_info("key"), # $ tainted
-
-        # Like request.transport.get_extra_info
-        request.protocol.transport.get_extra_info("key"), # $ MISSING: tainted
-
-        # bytes
-        await request.read(), # $ tainted
-
-        # str
-        await request.text(), # $ tainted
-
-        # obj
-        await request.json(), # $ tainted
-
-        # aiohttp.multipart.MultipartReader
-        await request.multipart(), # $ tainted
-
-        # multidict.MultiDictProxy[str] (see `multidict` framework tests)
-        await request.post(), # $ tainted
-        (await request.post()).getone("key"), # $ tainted
-    )
-
-    # things that are technically controlled by sender of request,
-    # but doesn't seem that likely for exploitation.
-    ensure_not_tainted(
-        request.method,
-        request.version,
-        request.scheme,
-        request.secure,
-        request.keep_alive,
-
-        request.content_length,
-        request.body_exists,
-        request.has_body,
-        request.can_read_body,
-    )
-
-    ensure_not_tainted(
-        request.loop,
-
-        request.app,
-        request.config_dict,
-    )
-
-
 async def test_taint(request: web.Request): # $ requestHandler
 
     ensure_tainted(
@@ -271,6 +142,17 @@ def get(self): # $ requestHandler
             self.request.url # $ tainted
         )
 
+# not a request handler, and not called, btu since we have type-annotation, should be a
+# remote-flow-source.
+async def test_heuristic_taint(request: web.Request):
+    # picking out just a few of the tests from `test_taint` above, to show that we have
+    # the same taint-steps :)
+    ensure_tainted(
+        request, # $ tainted
+        request.url, # $ tainted
+        await request.content.read(), # $ tainted
+    )
+
 
 app = web.Application()
 app.router.add_get(r"/test_taint/{name}/{number:\d+}", test_taint)  # $ routeSetup="/test_taint/{name}/{number:\d+}"