seaworthycode 1.1.2 → 1.1.4

package/rules/internal/taint/python.test.yaml

@@ -0,0 +1,427 @@
+language: python
+cases:
+  - name: "AC-4.6: XSS flow in Python — request.args to flask.render_template_string"
+    language: python
+    code: |
+      flask.render_template_string(f"Hello {request.args.get('name')}")
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: flask.render_template_string
+
+  - name: "AC-4.7: XSS sanitised by html.escape in Python — no finding"
+    language: python
+    code: |
+      flask.render_template_string(html.escape(request.args.get("name")))
+    expect:
+      count: 0
+
+  - name: "AC-4.8: html.escape sanitiser does not cover sql-injection"
+    language: python
+    code: |
+      cursor.execute(html.escape(request.args.get("name")))
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: cursor.execute
+
+  - name: "SQL injection in Python — request.args to cursor.execute"
+    language: python
+    code: |
+      cursor.execute("SELECT * FROM users WHERE name = " + request.args.get("name"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: cursor.execute
+
+  - name: "SQL injection sanitised by parameterised query in Python"
+    language: python
+    code: |
+      cursor.execute("SELECT * FROM users WHERE name = ?", [request.args.get("name")])
+    expect:
+      count: 0
+
+  - name: "Command injection in Python — sys.argv to os.system"
+    language: python
+    code: |
+      os.system(sys.argv[1])
+    expect:
+      count: 1
+      flows:
+        - sourceId: sys.argv
+          sinkId: os.system
+
+  - name: "Path traversal in Python — request.args to open"
+    language: python
+    code: |
+      open(request.args.get("file"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: open-write
+
+  - name: "Path traversal sanitised by os.path.realpath in Python"
+    language: python
+    code: |
+      open(os.path.realpath(request.args.get("file")))
+    expect:
+      count: 0
+
+  - name: "URL injection in Python — request.values to flask.redirect"
+    language: python
+    code: |
+      flask.redirect(request.values.get("next"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.values
+          sinkId: flask.redirect
+
+  - name: "URL injection sanitised by urllib.parse.quote in Python"
+    language: python
+    code: |
+      flask.redirect(urllib.parse.quote(request.args.get("next")))
+    expect:
+      count: 0
+
+  - name: "Prototype pollution via dict.update in Python"
+    language: python
+    code: |
+      config.update(request.json)
+    expect:
+      count: 1
+      flows:
+        - sourceId: flask.request.json
+          sinkId: dict.update
+
+  - name: "Prototype pollution sanitised by copy.deepcopy"
+    language: python
+    code: |
+      config.update(copy.deepcopy(request.json))
+    expect:
+      count: 0
+
+  - name: "Python — no source match returns zero flows"
+    language: python
+    code: |
+      print("hello world")
+    expect:
+      count: 0
+
+  - name: "Python — network response from requests.get to eval"
+    language: python
+    code: |
+      eval(requests.get("https://api.example.com/data").text)
+    expect:
+      count: 1
+      flows:
+        - sourceId: requests.response.text
+          sinkId: eval
+
+  - name: "Python — environment variable to subprocess.call"
+    language: python
+    code: |
+      subprocess.call(os.environ.get("CMD"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: os.environ.get
+          sinkId: subprocess.call
+
+  - name: "Python — input() to exec is code execution"
+    language: python
+    code: |
+      exec(input())
+    expect:
+      count: 1
+      flows:
+        - sourceId: input
+          sinkId: exec
+
+  - name: "Python — django request GET to HttpResponse"
+    language: python
+    code: |
+      HttpResponse("Hello " + request.GET.get("name"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: django.request.GET
+          sinkId: django.http.HttpResponse
+
+  - name: "FastAPI: query_params to cursor.execute"
+    language: python
+    code: |
+      cursor.execute("SELECT * FROM users WHERE id = " + request.query_params.get("id"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: starlette.request.query_params
+          sinkId: cursor.execute
+
+  - name: "FastAPI: parameterised execute blocks SQLi"
+    language: python
+    code: |
+      cursor.execute("SELECT * FROM users WHERE id = ?", [request.query_params.get("id")])
+    expect:
+      count: 0
+
+  - name: "Python safe anti-fixture: escape and parameterised query"
+    language: python
+    code: |
+      safe = html.escape(request.args.get("name"))
+      cursor.execute("SELECT * FROM users WHERE name = ?", [request.args.get("name")])
+      flask.render_template_string(safe)
+    expect:
+      count: 0
+
+  - name: "Python — request cookies to pickle.loads (code execution)"
+    language: python
+    code: |
+      pickle.loads(request.cookies.get("session"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.cookies
+          sinkId: pickle.loads
+
+  - name: "Python — Django cookies to yaml.unsafe_load (code execution)"
+    language: python
+    code: |
+      yaml.unsafe_load(request.COOKIES.get("prefs"))
+    expect:
+      count: 2
+      flows:
+        - sourceId: request.cookies
+          sinkId: yaml.unsafe_load
+        - sourceId: django.request.COOKIES
+          sinkId: yaml.unsafe_load
+
+  - name: "Python — request headers to starlette.RedirectResponse (open redirect)"
+    language: python
+    code: |
+      RedirectResponse(request.headers.get("referrer"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.headers
+          sinkId: starlette.RedirectResponse
+
+  - name: "Python — Flask headers to Starlette HTMLResponse (XSS)"
+    language: python
+    code: |
+      HTMLResponse("Hello " + request.headers.get("name"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.headers
+          sinkId: starlette.HTMLResponse
+
+  - name: "Python — Flask args to Jinja2 Template render (XSS)"
+    language: python
+    code: |
+      Template("Hello " + request.args.get("name")).render()
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: jinja2.Template
+
+  - name: "Python — Django request GET to Django .raw() SQL query"
+    language: python
+    code: |
+      User.objects.raw("SELECT * FROM users WHERE name = '" + request.GET.get("name") + "'")
+    expect:
+      count: 1
+      flows:
+        - sourceId: django.request.GET
+          sinkId: django.db.models.raw
+
+  - name: "Python — Django request POST to RawSQL expression"
+    language: python
+    code: |
+      User.objects.annotate(val=RawSQL("SELECT '" + request.POST.get("role") + "'", []))
+    expect:
+      count: 1
+      flows:
+        - sourceId: django.request.POST
+          sinkId: django.db.models.expressions.RawSQL
+
+  - name: "Python BFS: f-string interpolation propagates taint to sink"
+    language: python
+    code: |
+      cursor.execute(f"SELECT * FROM users WHERE name = {request.args.get('name')}")
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: cursor.execute
+
+  - name: "Python BFS: f-string interpolation sanitised by parameterised query"
+    language: python
+    code: |
+      name = html.escape(request.args.get('name'))
+      cursor.execute(f"SELECT * FROM users WHERE name = {name}")
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: cursor.execute
+
+  - name: "Python BFS: list comprehension propagates taint from source collection"
+    language: python
+    code: |
+      os.system([x for x in request.args.getlist('name')][0])
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: os.system
+
+  - name: "Python BFS: dict comprehension propagates taint"
+    language: python
+    code: |
+      cursor.execute({k: v for k, v in request.args.items()}.get('q'))
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: cursor.execute
+
+  - name: "Python BFS: starred expression propagates taint through *args"
+    language: python
+    code: |
+      os.system(*request.args.getlist('cmd'))
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: os.system
+
+  - name: "Python BFS: **kwargs splat propagates taint"
+    language: python
+    code: |
+      config.update(**request.json)
+    expect:
+      count: 1
+      flows:
+        - sourceId: flask.request.json
+          sinkId: dict.update
+
+  - name: "Python BFS: subscript assignment taints container object"
+    language: python
+    code: |
+      data = {}
+      data['key'] = request.args.get('name')
+      cursor.execute(data['key'])
+    expect:
+      count: 0
+
+  - name: "Python BFS: attribute assignment taints container object"
+    language: python
+    code: |
+      class Obj:
+        pass
+      obj = Obj()
+      obj.name = request.args.get('name')
+      cursor.execute(obj.name)
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: cursor.execute
+
+  - name: "Set comprehension BFS: taint propagates through set comprehension"
+    language: python
+    code: |
+      os.system({x for x in request.args.getlist('name')}.pop())
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: os.system
+
+  - name: "Augmented assignment BFS: taint via += propagates to sink"
+    language: python
+    code: |
+      name = ""
+      name += request.args.get("name")
+      cursor.execute(name)
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: cursor.execute
+
+  - name: "Mutator method BFS: taint via .append() to list then sink"
+    language: python
+    code: |
+      data = []
+      data.append(request.args.get("name"))
+      cursor.execute(data[0])
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: cursor.execute
+
+  - name: "Inter-function propagation: tainted arg -> return -> sink"
+    language: python
+    code: |
+      def process(value):
+          return value
+
+      name = process(request.args.get("name"))
+      cursor.execute(name)
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: cursor.execute
+
+  - name: "Return-value propagation: function returns tainted value to sink"
+    language: python
+    code: |
+      def get_name():
+          return request.args.get("name")
+
+      cursor.execute(get_name())
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: cursor.execute
+
+  - name: "Conditional branch merging: taint in if/else merges before sink"
+    language: python
+    code: |
+      if True:
+          name = request.args.get("name")
+      else:
+          name = "safe"
+
+      cursor.execute(name)
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: cursor.execute
+
+  - name: "Loop fixpoint: taint introduced inside loop body reaches sink after loop"
+    language: python
+    code: |
+      result = ""
+      for x in request.args.getlist("id"):
+          result = x
+
+      cursor.execute(result)
+    expect:
+      count: 1
+      flows:
+        - sourceId: request.args
+          sinkId: cursor.execute
+
+