codeql/python/ql/test/query-tests/Security/CWE-601/test.py at da021feb8b014574f8f7f4e6dcf9b651c82b8fda · github/codeql · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
from flask import Flask, request, redirect

app = Flask(__name__)

@app.route('/')
def hello():
    target = request.args.get('target', '')
    return redirect(target, code=302)


# Check for safe prefixes

@app.route('/ok')
def ok():
    untrusted = request.args.get('target', '')
    safe = "https://safe.com/"
    safe += untrusted
    return redirect(safe, code=302)


@app.route('/ok2')
def ok2():
    untrusted = request.args.get('target', '')
    safe = "https://safe.com/" + untrusted
    return redirect(safe, code=302)


@app.route('/ok3')
def ok3():
    untrusted = request.args.get('target', '')
    safe = "https://safe.com/{}".format(untrusted)
    return redirect(safe, code=302) # FP


@app.route('/ok4')
def ok4():
    untrusted = request.args.get('target', '')
    safe = f"https://safe.com/{untrusted}"
    return redirect(safe, code=302) # FP


@app.route('/ok5')
def ok5():
    untrusted = request.args.get('target', '')
    safe = "https://safe.com/%s" % untrusted
    return redirect(safe, code=302) # FP


@app.route('/const-str-compare')
def const_str_compare():
    target = request.args.get('target', '')
    if target == "example.com/":
        return redirect(target, code=302)


# Check that our sanitizer is not too broad

@app.route('/not_ok1')
def not_ok1():
    untrusted = request.args.get('target', '')
    unsafe = untrusted + "?login=success"
    return redirect(unsafe, code=302)


@app.route('/not_ok2')
def not_ok2():
    untrusted = request.args.get('target', '')
    unsafe = "{}?login=success".format(untrusted)
    return redirect(unsafe, code=302)


@app.route('/not_ok3')
def not_ok3():
    untrusted = request.args.get('target', '')
    unsafe = f"{untrusted}?login=success"
    return redirect(unsafe, code=302)


@app.route('/not_ok4')
def not_ok4():
    untrusted = request.args.get('target', '')
    unsafe = "%s?login=success" % untrusted
    return redirect(unsafe, code=302)