Mercurial Repositories > eric / file comparison
comparison: eric6/Plugins/CheckerPlugins/CodeStyleChecker/Security/Checks/djangoXssVulnerability.py
eric6/Plugins/CheckerPlugins/CodeStyleChecker/Security/Checks/djangoXssVulnerability.py
- changeset 8221
- 0572a215bd2f
- parent 8220
- 006ee31b4835
- child 8259
- 2bbec88047dd
equal
deleted
inserted
replaced
| 8220:006ee31b4835 | 8221:0572a215bd2f |
|---|---|
| 157 @type ast.AST | 157 @type ast.AST |
| 158 @return flag indicating an assignement | 158 @return flag indicating an assignement |
| 159 @rtype bool | 159 @rtype bool |
| 160 """ | 160 """ |
| 161 assigned = False | 161 assigned = False |
| 162 if self.__ignoreNodes: | 162 if ( |
| 163 if isinstance(self.__ignoreNodes, (list, tuple, object)): | 163 self.__ignoreNodes and |
| 164 if isinstance(node, self.__ignoreNodes): | 164 isinstance(self.__ignoreNodes, (list, tuple, object)) and |
| 165 return assigned | 165 isinstance(node, self.__ignoreNodes) |
| 166 ): | |
| 167 return assigned | |
| 166 | 168 |
| 167 if isinstance(node, ast.Expr): | 169 if isinstance(node, ast.Expr): |
| 168 assigned = self.isAssigned(node.value) | 170 assigned = self.isAssigned(node.value) |
| 169 elif isinstance(node, ast.FunctionDef): | 171 elif isinstance(node, ast.FunctionDef): |
| 170 for name in node.args.args: | 172 for name in node.args.args: |
| 171 if isinstance(name, ast.Name): | 173 if ( |
| 172 if name.id == self.var_name.id: | 174 isinstance(name, ast.Name) and |
| 173 # If is param the assignations are not affected | 175 name.id == self.var_name.id |
| 174 return assigned | 176 ): |
| 177 # If is param the assignations are not affected | |
| 178 return assigned | |
| 175 | 179 |
| 176 assigned = self.isAssignedIn(node.body) | 180 assigned = self.isAssignedIn(node.body) |
| 177 elif isinstance(node, ast.With): | 181 elif isinstance(node, ast.With): |
| 178 for withitem in node.items: | 182 for withitem in node.items: |
| 179 varId = getattr(withitem.optional_vars, 'id', None) | 183 varId = getattr(withitem.optional_vars, 'id', None) |
| 192 assigned.extend(self.isAssignedIn(node.body)) | 196 assigned.extend(self.isAssignedIn(node.body)) |
| 193 elif isinstance(node, (ast.If, ast.For, ast.While)): | 197 elif isinstance(node, (ast.If, ast.For, ast.While)): |
| 194 assigned = [] | 198 assigned = [] |
| 195 assigned.extend(self.isAssignedIn(node.body)) | 199 assigned.extend(self.isAssignedIn(node.body)) |
| 196 assigned.extend(self.isAssignedIn(node.orelse)) | 200 assigned.extend(self.isAssignedIn(node.orelse)) |
| 197 elif isinstance(node, ast.AugAssign): | 201 elif ( |
| 198 if isinstance(node.target, ast.Name): | 202 isinstance(node, ast.AugAssign) and |
| 199 if node.target.id == self.__varName.id: | 203 isinstance(node.target, ast.Name) and |
| 200 assigned = node.value | 204 node.target.id == self.__varName.id |
| 205 ): | |
| 206 assigned = node.value | |
| 201 elif isinstance(node, ast.Assign) and node.targets: | 207 elif isinstance(node, ast.Assign) and node.targets: |
| 202 target = node.targets[0] | 208 target = node.targets[0] |
| 203 if isinstance(target, ast.Name): | 209 if isinstance(target, ast.Name): |
| 204 if target.id == self.__varName.id: | 210 if target.id == self.__varName.id: |
| 205 assigned = node.value | 211 assigned = node.value |
| 227 @return flag indicating a secure evaluation | 233 @return flag indicating a secure evaluation |
| 228 @rtype bool | 234 @rtype bool |
| 229 """ | 235 """ |
| 230 secure = False | 236 secure = False |
| 231 if isinstance(xssVar, ast.Name): | 237 if isinstance(xssVar, ast.Name): |
| 232 if isinstance(parent, ast.FunctionDef): | 238 if ( |
| 233 for name in parent.args.args: | 239 isinstance(parent, ast.FunctionDef) and |
| 234 if name.arg == xssVar.id: | 240 any(name.arg == xssVar.id for name in parent.args.args) |
| 235 return False # Params are not secure | 241 ): |
| 242 return False # Params are not secure | |
| 236 | 243 |
| 237 analyser = DeepAssignation(xssVar, ignoreNodes) | 244 analyser = DeepAssignation(xssVar, ignoreNodes) |
| 238 for node in parent.body: | 245 for node in parent.body: |
| 239 if node.lineno >= until: | 246 if node.lineno >= until: |
| 240 break | 247 break |
| 286 @rtype bool | 293 @rtype bool |
| 287 """ | 294 """ |
| 288 secure = False | 295 secure = False |
| 289 evaluate = False | 296 evaluate = False |
| 290 | 297 |
| 291 if isinstance(call, ast.Call) and isinstance(call.func, ast.Attribute): | 298 if ( |
| 292 if ( | 299 isinstance(call, ast.Call) and |
| 293 AstUtilities.isString(call.func.value) and | 300 isinstance(call.func, ast.Attribute) and |
| 294 call.func.attr == 'format' | 301 AstUtilities.isString(call.func.value) and |
| 295 ): | 302 call.func.attr == 'format' |
| 296 evaluate = True | 303 ): |
| 297 if call.keywords: | 304 evaluate = True |
| 298 evaluate = False | 305 if call.keywords: |
| 306 evaluate = False | |
| 299 | 307 |
| 300 if evaluate: | 308 if evaluate: |
| 301 args = list(call.args) | 309 args = list(call.args) |
| 302 | 310 |
| 303 numSecure = 0 | 311 numSecure = 0 |
