Mercurial Repositories > eric / file comparison
comparison: eric6/Plugins/CheckerPlugins/CodeStyleChecker/Security/Checks/djangoXssVulnerability.py
eric6/Plugins/CheckerPlugins/CodeStyleChecker/Security/Checks/djangoXssVulnerability.py
- changeset 7622
- 384e2aa5c073
- parent 7619
- ef2b5af23ce7
- child 7637
- c878e8255972
equal
deleted
inserted
replaced
| 7621:ffd1f00ca376 | 7622:384e2aa5c073 |
|---|---|
| 15 # SPDX-License-Identifier: Apache-2.0 | 15 # SPDX-License-Identifier: Apache-2.0 |
| 16 # | 16 # |
| 17 | 17 |
| 18 import ast | 18 import ast |
| 19 import sys | 19 import sys |
| 20 | |
| 21 import AstUtilities | |
| 20 | 22 |
| 21 PY2 = sys.version_info[0] == 2 | 23 PY2 = sys.version_info[0] == 2 |
| 22 | 24 |
| 23 | 25 |
| 24 def getChecks(): | 26 def getChecks(): |
| 55 'SafeString', | 57 'SafeString', |
| 56 'SafeBytes' | 58 'SafeBytes' |
| 57 ] | 59 ] |
| 58 if context.callFunctionName in affectedFunctions: | 60 if context.callFunctionName in affectedFunctions: |
| 59 xss = context.node.args[0] | 61 xss = context.node.args[0] |
| 60 if not isinstance(xss, ast.Str): | 62 if not AstUtilities.isString(xss): |
| 61 checkPotentialRisk(reportError, context.node) | 63 checkPotentialRisk(reportError, context.node) |
| 62 | 64 |
| 63 | 65 |
| 64 def checkPotentialRisk(reportError, node): | 66 def checkPotentialRisk(reportError, node): |
| 65 """ | 67 """ |
| 95 while not isinstance(parent, (ast.Module, ast.FunctionDef)): | 97 while not isinstance(parent, (ast.Module, ast.FunctionDef)): |
| 96 parent = parent._securityParent | 98 parent = parent._securityParent |
| 97 secure = evaluateCall(xssVar, parent) | 99 secure = evaluateCall(xssVar, parent) |
| 98 elif isinstance(xssVar, ast.BinOp): | 100 elif isinstance(xssVar, ast.BinOp): |
| 99 isMod = isinstance(xssVar.op, ast.Mod) | 101 isMod = isinstance(xssVar.op, ast.Mod) |
| 100 isLeftStr = isinstance(xssVar.left, ast.Str) | 102 isLeftStr = AstUtilities.isString(xssVar.left) |
| 101 if isMod and isLeftStr: | 103 if isMod and isLeftStr: |
| 102 parent = node._securityParent | 104 parent = node._securityParent |
| 103 while not isinstance(parent, (ast.Module, ast.FunctionDef)): | 105 while not isinstance(parent, (ast.Module, ast.FunctionDef)): |
| 104 parent = parent._securityParent | 106 parent = parent._securityParent |
| 105 newCall = transform2call(xssVar) | 107 newCall = transform2call(xssVar) |
| 258 for node in parent.body: | 260 for node in parent.body: |
| 259 if node.lineno >= until: | 261 if node.lineno >= until: |
| 260 break | 262 break |
| 261 to = analyser.isAssigned(node) | 263 to = analyser.isAssigned(node) |
| 262 if to: | 264 if to: |
| 263 if isinstance(to, ast.Str): | 265 if AstUtilities.isString(to): |
| 264 secure = True | 266 secure = True |
| 265 elif isinstance(to, ast.Name): | 267 elif isinstance(to, ast.Name): |
| 266 secure = evaluateVar( | 268 secure = evaluateVar( |
| 267 to, parent, to.lineno, ignoreNodes) | 269 to, parent, to.lineno, ignoreNodes) |
| 268 elif isinstance(to, ast.Call): | 270 elif isinstance(to, ast.Call): |
| 269 secure = evaluateCall(to, parent, ignoreNodes) | 271 secure = evaluateCall(to, parent, ignoreNodes) |
| 270 elif isinstance(to, (list, tuple)): | 272 elif isinstance(to, (list, tuple)): |
| 271 numSecure = 0 | 273 numSecure = 0 |
| 272 for someTo in to: | 274 for someTo in to: |
| 273 if isinstance(someTo, ast.Str): | 275 if AstUtilities.isString(someTo): |
| 274 numSecure += 1 | 276 numSecure += 1 |
| 275 elif isinstance(someTo, ast.Name): | 277 elif isinstance(someTo, ast.Name): |
| 276 if evaluateVar(someTo, parent, | 278 if evaluateVar(someTo, parent, |
| 277 node.lineno, ignoreNodes): | 279 node.lineno, ignoreNodes): |
| 278 numSecure += 1 | 280 numSecure += 1 |
| 307 """ | 309 """ |
| 308 secure = False | 310 secure = False |
| 309 evaluate = False | 311 evaluate = False |
| 310 | 312 |
| 311 if isinstance(call, ast.Call) and isinstance(call.func, ast.Attribute): | 313 if isinstance(call, ast.Call) and isinstance(call.func, ast.Attribute): |
| 312 if isinstance(call.func.value, ast.Str) and call.func.attr == 'format': | 314 if ( |
| 315 AstUtilities.isString(call.func.value) and | |
| 316 call.func.attr == 'format' | |
| 317 ): | |
| 313 evaluate = True | 318 evaluate = True |
| 314 if call.keywords or (PY2 and call.kwargs): | 319 if call.keywords or (PY2 and call.kwargs): |
| 315 evaluate = False | 320 evaluate = False |
| 316 | 321 |
| 317 if evaluate: | 322 if evaluate: |
| 323 ): | 328 ): |
| 324 args.extend(call.starargs.elts) | 329 args.extend(call.starargs.elts) |
| 325 | 330 |
| 326 numSecure = 0 | 331 numSecure = 0 |
| 327 for arg in args: | 332 for arg in args: |
| 328 if isinstance(arg, ast.Str): | 333 if AstUtilities.isString(arg): |
| 329 numSecure += 1 | 334 numSecure += 1 |
| 330 elif isinstance(arg, ast.Name): | 335 elif isinstance(arg, ast.Name): |
| 331 if evaluateVar(arg, parent, call.lineno, ignoreNodes): | 336 if evaluateVar(arg, parent, call.lineno, ignoreNodes): |
| 332 numSecure += 1 | 337 numSecure += 1 |
| 333 else: | 338 else: |
| 360 @return call node | 365 @return call node |
| 361 @rtype ast.Call | 366 @rtype ast.Call |
| 362 """ | 367 """ |
| 363 if isinstance(var, ast.BinOp): | 368 if isinstance(var, ast.BinOp): |
| 364 isMod = isinstance(var.op, ast.Mod) | 369 isMod = isinstance(var.op, ast.Mod) |
| 365 isLeftStr = isinstance(var.left, ast.Str) | 370 isLeftStr = AstUtilities.isString(var.left) |
| 366 if isMod and isLeftStr: | 371 if isMod and isLeftStr: |
| 367 newCall = ast.Call() | 372 newCall = ast.Call() |
| 368 newCall.args = [] | 373 newCall.args = [] |
| 369 newCall.args = [] | 374 newCall.args = [] |
| 370 if PY2: | 375 if PY2: |
