codeql/python/ql/test/query-tests/Security/CWE-643-XPathInjection/xpathFlow.py at 4da0508dae904a6bc7ec06e3ccdd58ecf2b3acd2 · github/codeql · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
from io import StringIO
from flask import Flask, request

app = Flask(__name__)


@app.route("/xpath1")
def xpath1():
    from lxml import etree

    xpathQuery = request.args.get('xml', '')
    f = StringIO('<foo><bar></bar></foo>')
    tree = etree.parse(f)
    r = tree.xpath(xpathQuery)


@app.route("/xpath2")
def xpath2():
    from lxml import etree
    xpathQuery = request.args.get('xml', '')

    root = etree.XML("<root><a>TEXT</a></root>")
    find_text = etree.XPath(xpathQuery)
    text = find_text(root)[0]


@app.route("/xpath3")
def xpath3():
    from lxml import etree
    xpathQuery = request.args.get('xml', '')
    root = etree.XML("<root><a>TEXT</a></root>")
    find_text = etree.XPath(xpathQuery, smart_strings=False)
    text = find_text(root)[0]


@app.route("/xpath4")
def xpath4():
    from lxml import etree
    xpathQuery = request.args.get('xml', '')
    root = etree.XML("<root><a>TEXT</a></root>")
    find_text = etree.ETXPath(xpathQuery)
    text = find_text(root)[0]

@app.route("/xpath5")
def xpath5():
    import libxml2
    xpathQuery = request.args.get('xml', '')
    doc = libxml2.parseFile('xpath_injection/credential.xml')
    results = doc.xpathEval(xpathQuery)