Python: Add explicit tests for HttpSources and HttpSinks

RasmusWL · RasmusWL · commit 6b87458c2e8e · 2020-01-28T13:06:48.000+01:00
Some of the tests currently fail, since they can't reproduce the old tests
results (since the sinks/sources defined in the library code are not
HttpResponseTaintSink/HttpRequestTaintSource)
diff --git a/python/ql/test/library-tests/web/bottle/HttpSinks.expected b/python/ql/test/library-tests/web/bottle/HttpSinks.expected
@@ -0,0 +1,4 @@
+| test.py:9:12:9:26 | bottle handler function result | externally controlled string |
+| test.py:13:12:13:24 | bottle handler function result | externally controlled string |
+| test.py:19:12:19:33 | bottle handler function result | externally controlled string |
+| test.py:36:21:36:51 | Taint sink | externally controlled string |
diff --git a/python/ql/test/library-tests/web/bottle/HttpSinks.ql b/python/ql/test/library-tests/web/bottle/HttpSinks.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpResponse
+import semmle.python.security.strings.Untrusted
+
+from HttpResponseTaintSink sink, TaintKind kind
+where sink.sinks(kind)
+select sink, kind
diff --git a/python/ql/test/library-tests/web/bottle/HttpSources.expected b/python/ql/test/library-tests/web/bottle/HttpSources.expected
@@ -0,0 +1 @@
+FIXME
diff --git a/python/ql/test/library-tests/web/bottle/HttpSources.ql b/python/ql/test/library-tests/web/bottle/HttpSources.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpRequest
+import semmle.python.security.strings.Untrusted
+
+from HttpRequestTaintSource source, TaintKind kind
+where source.isSourceOf(kind)
+select source.(ControlFlowNode).getNode(), kind
diff --git a/python/ql/test/library-tests/web/bottle/Sinks.expected b/python/ql/test/library-tests/web/bottle/Sinks.expected
diff --git a/python/ql/test/library-tests/web/bottle/Sinks.ql b/python/ql/test/library-tests/web/bottle/Sinks.ql
diff --git a/python/ql/test/library-tests/web/cherrypy/HttpSinks.expected b/python/ql/test/library-tests/web/cherrypy/HttpSinks.expected
@@ -0,0 +1,3 @@
+| red.py:8:16:8:20 | cherrypy handler function result | externally controlled string |
+| test.py:11:16:11:29 | cherrypy handler function result | externally controlled string |
+| test.py:17:16:17:27 | cherrypy handler function result | externally controlled string |
diff --git a/python/ql/test/library-tests/web/cherrypy/HttpSinks.ql b/python/ql/test/library-tests/web/cherrypy/HttpSinks.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpResponse
+import semmle.python.security.strings.Untrusted
+
+from HttpResponseTaintSink sink, TaintKind kind
+where sink.sinks(kind)
+select sink, kind
diff --git a/python/ql/test/library-tests/web/cherrypy/HttpSources.expected b/python/ql/test/library-tests/web/cherrypy/HttpSources.expected
@@ -0,0 +1 @@
+FIXME
diff --git a/python/ql/test/library-tests/web/cherrypy/HttpSources.ql b/python/ql/test/library-tests/web/cherrypy/HttpSources.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpRequest
+import semmle.python.security.strings.Untrusted
+
+from HttpRequestTaintSource source, TaintKind kind
+where source.isSourceOf(kind)
+select source.(ControlFlowNode).getNode(), kind
diff --git a/python/ql/test/library-tests/web/cherrypy/Sinks.expected b/python/ql/test/library-tests/web/cherrypy/Sinks.expected
diff --git a/python/ql/test/library-tests/web/cherrypy/Sinks.ql b/python/ql/test/library-tests/web/cherrypy/Sinks.ql
diff --git a/python/ql/test/library-tests/web/django/HttpSinks.expected b/python/ql/test/library-tests/web/django/HttpSinks.expected
@@ -0,0 +1,7 @@
+| views.py:7:25:7:63 | django.Response(...) | externally controlled string |
+| views.py:11:25:11:52 | django.Response(...) | externally controlled string |
+| views.py:15:25:15:53 | django.Response(...) | externally controlled string |
+| views.py:23:29:23:60 | django.Response(...) | externally controlled string |
+| views.py:29:29:29:65 | django.Response(...) | externally controlled string |
+| views.py:34:25:34:63 | django.Response(...) | externally controlled string |
+| views.py:38:25:38:70 | django.Response(...) | externally controlled string |
diff --git a/python/ql/test/library-tests/web/django/HttpSinks.ql b/python/ql/test/library-tests/web/django/HttpSinks.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpResponse
+import semmle.python.security.strings.Untrusted
+
+from HttpResponseTaintSink sink, TaintKind kind
+where sink.sinks(kind)
+select sink, kind
diff --git a/python/ql/test/library-tests/web/django/HttpSources.expected b/python/ql/test/library-tests/web/django/HttpSources.expected
@@ -0,0 +1,19 @@
+| test.py:5:19:5:25 | request | django.request.HttpRequest |
+| test.py:5:28:5:31 | path | externally controlled string |
+| test.py:11:19:11:25 | request | django.request.HttpRequest |
+| test.py:11:28:11:31 | path | externally controlled string |
+| views.py:6:19:6:25 | request | django.request.HttpRequest |
+| views.py:6:28:6:30 | foo | externally controlled string |
+| views.py:6:33:6:35 | bar | externally controlled string |
+| views.py:10:20:10:26 | request | django.request.HttpRequest |
+| views.py:14:21:14:27 | request | django.request.HttpRequest |
+| views.py:22:20:22:26 | request | django.request.HttpRequest |
+| views.py:28:19:28:25 | request | django.request.HttpRequest |
+| views.py:32:19:32:25 | request | django.request.HttpRequest |
+| views.py:32:28:32:38 | page_number | externally controlled string |
+| views.py:37:24:37:30 | request | django.request.HttpRequest |
+| views.py:37:33:37:36 | arg0 | externally controlled string |
+| views.py:37:39:37:42 | arg1 | externally controlled string |
+| views.py:57:15:57:21 | request | django.request.HttpRequest |
+| views.py:57:24:57:31 | username | externally controlled string |
+| views.py:66:30:66:36 | request | django.request.HttpRequest |
diff --git a/python/ql/test/library-tests/web/django/HttpSources.ql b/python/ql/test/library-tests/web/django/HttpSources.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpRequest
+import semmle.python.security.strings.Untrusted
+
+from HttpRequestTaintSource source, TaintKind kind
+where source.isSourceOf(kind)
+select source.(ControlFlowNode).getNode(), kind
diff --git a/python/ql/test/library-tests/web/django/Sinks.expected b/python/ql/test/library-tests/web/django/Sinks.expected
diff --git a/python/ql/test/library-tests/web/django/Sinks.ql b/python/ql/test/library-tests/web/django/Sinks.ql
diff --git a/python/ql/test/library-tests/web/django/Sources.expected b/python/ql/test/library-tests/web/django/Sources.expected
diff --git a/python/ql/test/library-tests/web/django/Sources.ql b/python/ql/test/library-tests/web/django/Sources.ql
diff --git a/python/ql/test/library-tests/web/django/SqlInjectionSinks.expected b/python/ql/test/library-tests/web/django/SqlInjectionSinks.expected
@@ -0,0 +1,9 @@
+| sql.py:13:24:13:64 | db.connection.execute | externally controlled string |
+| sql.py:14:26:14:66 | django.models.QuerySet.raw(sink,...) | externally controlled string |
+| sql.py:17:24:17:77 | db.connection.execute | externally controlled string |
+| sql.py:20:38:20:95 | django.db.models.expressions.RawSQL(sink,...) | externally controlled string |
+| sql.py:21:26:21:83 | django.models.QuerySet.raw(sink,...) | externally controlled string |
+| sql.py:22:28:22:85 | django.models.QuerySet.extra(sink,...) | externally controlled string |
+| sql.py:36:26:36:68 | django.models.QuerySet.raw(sink,...) | externally controlled string |
+| sql.py:42:11:42:52 | django.models.QuerySet.raw(sink,...) | externally controlled string |
+| sql.py:47:13:47:54 | django.models.QuerySet.extra(sink,...) | externally controlled string |
diff --git a/python/ql/test/library-tests/web/django/SqlInjectionSinks.ql b/python/ql/test/library-tests/web/django/SqlInjectionSinks.ql
@@ -0,0 +1,9 @@
+import python
+import semmle.python.security.injection.Sql
+import semmle.python.web.django.Db
+import semmle.python.web.django.Model
+import semmle.python.security.strings.Untrusted
+
+from SqlInjectionSink sink, TaintKind kind
+where sink.sinks(kind)
+select sink, kind
diff --git a/python/ql/test/library-tests/web/falcon/HttpSinks.expected b/python/ql/test/library-tests/web/falcon/HttpSinks.expected
@@ -0,0 +1 @@
+FIXME
diff --git a/python/ql/test/library-tests/web/falcon/HttpSinks.ql b/python/ql/test/library-tests/web/falcon/HttpSinks.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpResponse
+import semmle.python.security.strings.Untrusted
+
+from HttpResponseTaintSink sink, TaintKind kind
+where sink.sinks(kind)
+select sink, kind
diff --git a/python/ql/test/library-tests/web/falcon/HttpSources.expected b/python/ql/test/library-tests/web/falcon/HttpSources.expected
@@ -0,0 +1 @@
+FIXME
diff --git a/python/ql/test/library-tests/web/falcon/HttpSources.ql b/python/ql/test/library-tests/web/falcon/HttpSources.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpRequest
+import semmle.python.security.strings.Untrusted
+
+from HttpRequestTaintSource source, TaintKind kind
+where source.isSourceOf(kind)
+select source.(ControlFlowNode).getNode(), kind
diff --git a/python/ql/test/library-tests/web/flask/HttpSinks.expected b/python/ql/test/library-tests/web/flask/HttpSinks.expected
@@ -0,0 +1,8 @@
+| test.py:8:12:8:25 | flask.routed.response | externally controlled string |
+| test.py:29:12:29:38 | flask.routed.response | externally controlled string |
+| test.py:35:16:35:37 | flask.routed.response | externally controlled string |
+| test.py:36:12:36:15 | flask.routed.response | externally controlled string |
+| test.py:41:12:41:54 | flask.routed.response | externally controlled string |
+| test.py:41:26:41:53 | flask.response.argument | externally controlled string |
+| test.py:46:12:46:62 | flask.routed.response | externally controlled string |
+| test.py:46:26:46:61 | flask.response.argument | externally controlled string |
diff --git a/python/ql/test/library-tests/web/flask/HttpSinks.ql b/python/ql/test/library-tests/web/flask/HttpSinks.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpResponse
+import semmle.python.security.strings.Untrusted
+
+from HttpResponseTaintSink sink, TaintKind kind
+where sink.sinks(kind)
+select sink, kind
diff --git a/python/ql/test/library-tests/web/flask/HttpSources.expected b/python/ql/test/library-tests/web/flask/HttpSources.expected
@@ -0,0 +1,5 @@
+| test.py:29:12:29:23 | Attribute | {externally controlled string} |
+| test.py:33:9:33:20 | Attribute | {externally controlled string} |
+| test.py:35:16:35:27 | Attribute | {externally controlled string} |
+| test.py:40:18:40:29 | Attribute | {externally controlled string} |
+| test.py:45:18:45:29 | Attribute | {externally controlled string} |
diff --git a/python/ql/test/library-tests/web/flask/HttpSources.ql b/python/ql/test/library-tests/web/flask/HttpSources.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpRequest
+import semmle.python.security.strings.Untrusted
+
+from HttpRequestTaintSource source, TaintKind kind
+where source.isSourceOf(kind)
+select source.(ControlFlowNode).getNode(), kind
diff --git a/python/ql/test/library-tests/web/flask/Sinks.expected b/python/ql/test/library-tests/web/flask/Sinks.expected
diff --git a/python/ql/test/library-tests/web/flask/Sinks.ql b/python/ql/test/library-tests/web/flask/Sinks.ql
diff --git a/python/ql/test/library-tests/web/flask/Sources.expected b/python/ql/test/library-tests/web/flask/Sources.expected
diff --git a/python/ql/test/library-tests/web/flask/Sources.ql b/python/ql/test/library-tests/web/flask/Sources.ql
diff --git a/python/ql/test/library-tests/web/pyramid/HttpSinks.expected b/python/ql/test/library-tests/web/pyramid/HttpSinks.expected
@@ -0,0 +1,3 @@
+| test.py:8:12:8:31 | pyramid.routed.response | externally controlled string |
+| test.py:17:12:17:41 | pyramid.routed.response | externally controlled string |
+| test.py:25:12:25:43 | pyramid.routed.response | externally controlled string |
diff --git a/python/ql/test/library-tests/web/pyramid/HttpSinks.ql b/python/ql/test/library-tests/web/pyramid/HttpSinks.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpResponse
+import semmle.python.security.strings.Untrusted
+
+from HttpResponseTaintSink sink, TaintKind kind
+where sink.sinks(kind)
+select sink, kind
diff --git a/python/ql/test/library-tests/web/pyramid/HttpSources.expected b/python/ql/test/library-tests/web/pyramid/HttpSources.expected
@@ -0,0 +1 @@
+FIXME
diff --git a/python/ql/test/library-tests/web/pyramid/HttpSources.ql b/python/ql/test/library-tests/web/pyramid/HttpSources.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpRequest
+import semmle.python.security.strings.Untrusted
+
+from HttpRequestTaintSource source, TaintKind kind
+where source.isSourceOf(kind)
+select source.(ControlFlowNode).getNode(), kind
diff --git a/python/ql/test/library-tests/web/pyramid/Sinks.expected b/python/ql/test/library-tests/web/pyramid/Sinks.expected
diff --git a/python/ql/test/library-tests/web/pyramid/Sinks.ql b/python/ql/test/library-tests/web/pyramid/Sinks.ql
diff --git a/python/ql/test/library-tests/web/tornado/HttpSinks.expected b/python/ql/test/library-tests/web/tornado/HttpSinks.expected
@@ -0,0 +1,8 @@
+| test.py:6:20:6:43 | tornado.HttpRequesHandler.write | externally controlled string |
+| test.py:6:20:6:43 | tornado.connection.write | externally controlled string |
+| test.py:12:20:12:23 | tornado.HttpRequesHandler.write | externally controlled string |
+| test.py:12:20:12:23 | tornado.connection.write | externally controlled string |
+| test.py:20:23:20:25 | tornado.HttpRequesHandler.redirect | externally controlled string |
+| test.py:26:20:26:48 | tornado.HttpRequesHandler.write | externally controlled string |
+| test.py:26:20:26:48 | tornado.connection.write | externally controlled string |
+FIXME
diff --git a/python/ql/test/library-tests/web/tornado/HttpSinks.ql b/python/ql/test/library-tests/web/tornado/HttpSinks.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpResponse
+import semmle.python.security.strings.Untrusted
+
+from HttpResponseTaintSink sink, TaintKind kind
+where sink.sinks(kind)
+select sink, kind
diff --git a/python/ql/test/library-tests/web/tornado/HttpSources.expected b/python/ql/test/library-tests/web/tornado/HttpSources.expected
@@ -0,0 +1 @@
+FIXME
diff --git a/python/ql/test/library-tests/web/tornado/HttpSources.ql b/python/ql/test/library-tests/web/tornado/HttpSources.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpRequest
+import semmle.python.security.strings.Untrusted
+
+from HttpRequestTaintSource source, TaintKind kind
+where source.isSourceOf(kind)
+select source.(ControlFlowNode).getNode(), kind
diff --git a/python/ql/test/library-tests/web/tornado/Sinks.expected b/python/ql/test/library-tests/web/tornado/Sinks.expected
diff --git a/python/ql/test/library-tests/web/tornado/Sinks.ql b/python/ql/test/library-tests/web/tornado/Sinks.ql
diff --git a/python/ql/test/library-tests/web/turbogears/HttpSinks.expected b/python/ql/test/library-tests/web/turbogears/HttpSinks.expected
@@ -0,0 +1,6 @@
+| test.py:8:16:8:69 | Taint sink | externally controlled string |
+| test.py:14:16:14:50 | Taint sink | externally controlled string |
+| test.py:19:16:19:50 | Taint sink | externally controlled string |
+| test.py:23:16:23:50 | Taint sink | externally controlled string |
+| test.py:27:16:27:38 | Taint sink | {externally controlled string} |
+FIXME
diff --git a/python/ql/test/library-tests/web/turbogears/HttpSinks.ql b/python/ql/test/library-tests/web/turbogears/HttpSinks.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpResponse
+import semmle.python.security.strings.Untrusted
+
+from HttpResponseTaintSink sink, TaintKind kind
+where sink.sinks(kind)
+select sink, kind
diff --git a/python/ql/test/library-tests/web/turbogears/HttpSources.expected b/python/ql/test/library-tests/web/turbogears/HttpSources.expected
@@ -0,0 +1 @@
+FIXME
diff --git a/python/ql/test/library-tests/web/turbogears/HttpSources.ql b/python/ql/test/library-tests/web/turbogears/HttpSources.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpRequest
+import semmle.python.security.strings.Untrusted
+
+from HttpRequestTaintSource source, TaintKind kind
+where source.isSourceOf(kind)
+select source.(ControlFlowNode).getNode(), kind
diff --git a/python/ql/test/library-tests/web/twisted/HttpSinks.expected b/python/ql/test/library-tests/web/twisted/HttpSinks.expected
@@ -0,0 +1,6 @@
+FIXME: WHERE ARE THE FIRST ONES?
+| test.py:40:23:40:30 | Twisted request setter | externally controlled string |
+| test.py:44:27:44:31 | Twisted request setter | externally controlled string |
+| test.py:44:34:44:38 | Twisted request setter | externally controlled string |
+| test.py:45:27:45:31 | Twisted request setter | externally controlled string |
+| test.py:45:34:45:40 | Twisted request setter | externally controlled string |
diff --git a/python/ql/test/library-tests/web/twisted/HttpSinks.ql b/python/ql/test/library-tests/web/twisted/HttpSinks.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.web.HttpResponse
+import semmle.python.security.strings.Untrusted
+
+from HttpResponseTaintSink sink, TaintKind kind
+where sink.sinks(kind)
+select sink, kind
diff --git a/python/ql/test/library-tests/web/twisted/HttpSources.expected b/python/ql/test/library-tests/web/twisted/HttpSources.expected
@@ -0,0 +1 @@
+FIXME
diff --git a/python/ql/test/library-tests/web/twisted/HttpSources.ql b/python/ql/test/library-tests/web/twisted/HttpSources.ql

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+\| red.py:8:16:8:20 \| cherrypy handler function result \| externally controlled string \|`
	`2`	`+\| test.py:11:16:11:29 \| cherrypy handler function result \| externally controlled string \|`
	`3`	`+\| test.py:17:16:17:27 \| cherrypy handler function result \| externally controlled string \|`