Mercurial Repositories > eric / file comparison
comparison: eric6/Plugins/CheckerPlugins/CodeStyleChecker/Security/Checks/djangoXssVulnerability.py
eric6/Plugins/CheckerPlugins/CodeStyleChecker/Security/Checks/djangoXssVulnerability.py
- branch
- maintenance
- changeset 8273
- 698ae46f40a4
- parent 8259
- 2bbec88047dd
equal
deleted
inserted
replaced
| 8190:fb0ef164f536 | 8273:698ae46f40a4 |
|---|---|
| 111 "M", | 111 "M", |
| 112 "H" | 112 "H" |
| 113 ) | 113 ) |
| 114 | 114 |
| 115 | 115 |
| 116 class DeepAssignation(object): | 116 class DeepAssignation: |
| 117 """ | 117 """ |
| 118 Class to perform a deep analysis of an assign. | 118 Class to perform a deep analysis of an assign. |
| 119 """ | 119 """ |
| 120 def __init__(self, varName, ignoreNodes=None): | 120 def __init__(self, varName, ignoreNodes=None): |
| 121 """ | 121 """ |
| 157 @type ast.AST | 157 @type ast.AST |
| 158 @return flag indicating an assignement | 158 @return flag indicating an assignement |
| 159 @rtype bool | 159 @rtype bool |
| 160 """ | 160 """ |
| 161 assigned = False | 161 assigned = False |
| 162 if self.__ignoreNodes: | 162 if ( |
| 163 if isinstance(self.__ignoreNodes, (list, tuple, object)): | 163 self.__ignoreNodes and |
| 164 if isinstance(node, self.__ignoreNodes): | 164 isinstance(self.__ignoreNodes, (list, tuple, object)) and |
| 165 return assigned | 165 isinstance(node, self.__ignoreNodes) |
| 166 ): | |
| 167 return assigned | |
| 166 | 168 |
| 167 if isinstance(node, ast.Expr): | 169 if isinstance(node, ast.Expr): |
| 168 assigned = self.isAssigned(node.value) | 170 assigned = self.isAssigned(node.value) |
| 169 elif isinstance(node, ast.FunctionDef): | 171 elif isinstance(node, ast.FunctionDef): |
| 170 for name in node.args.args: | 172 for name in node.args.args: |
| 171 if isinstance(name, ast.Name): | 173 if ( |
| 172 if name.id == self.var_name.id: | 174 isinstance(name, ast.Name) and |
| 173 # If is param the assignations are not affected | 175 name.id == self.var_name.id |
| 174 return assigned | 176 ): |
| 177 # If is param the assignations are not affected | |
| 178 return assigned | |
| 175 | 179 |
| 176 assigned = self.isAssignedIn(node.body) | 180 assigned = self.isAssignedIn(node.body) |
| 177 elif isinstance(node, ast.With): | 181 elif isinstance(node, ast.With): |
| 178 for withitem in node.items: | 182 for withitem in node.items: |
| 179 varId = getattr(withitem.optional_vars, 'id', None) | 183 varId = getattr(withitem.optional_vars, 'id', None) |
| 180 if varId == self.__varName.id: | 184 assigned = ( |
| 181 assigned = node | 185 node |
| 182 else: | 186 if varId == self.__varName.id else |
| 183 assigned = self.isAssignedIn(node.body) | 187 self.isAssignedIn(node.body) |
| 188 ) | |
| 184 elif isinstance(node, ast.Try): | 189 elif isinstance(node, ast.Try): |
| 185 assigned = [] | 190 assigned = [] |
| 186 assigned.extend(self.isAssignedIn(node.body)) | 191 assigned.extend(self.isAssignedIn(node.body)) |
| 187 assigned.extend(self.isAssignedIn(node.handlers)) | 192 assigned.extend(self.isAssignedIn(node.handlers)) |
| 188 assigned.extend(self.isAssignedIn(node.orelse)) | 193 assigned.extend(self.isAssignedIn(node.orelse)) |
| 192 assigned.extend(self.isAssignedIn(node.body)) | 197 assigned.extend(self.isAssignedIn(node.body)) |
| 193 elif isinstance(node, (ast.If, ast.For, ast.While)): | 198 elif isinstance(node, (ast.If, ast.For, ast.While)): |
| 194 assigned = [] | 199 assigned = [] |
| 195 assigned.extend(self.isAssignedIn(node.body)) | 200 assigned.extend(self.isAssignedIn(node.body)) |
| 196 assigned.extend(self.isAssignedIn(node.orelse)) | 201 assigned.extend(self.isAssignedIn(node.orelse)) |
| 197 elif isinstance(node, ast.AugAssign): | 202 elif ( |
| 198 if isinstance(node.target, ast.Name): | 203 isinstance(node, ast.AugAssign) and |
| 199 if node.target.id == self.__varName.id: | 204 isinstance(node.target, ast.Name) and |
| 200 assigned = node.value | 205 node.target.id == self.__varName.id |
| 206 ): | |
| 207 assigned = node.value | |
| 201 elif isinstance(node, ast.Assign) and node.targets: | 208 elif isinstance(node, ast.Assign) and node.targets: |
| 202 target = node.targets[0] | 209 target = node.targets[0] |
| 203 if isinstance(target, ast.Name): | 210 if isinstance(target, ast.Name): |
| 204 if target.id == self.__varName.id: | 211 if target.id == self.__varName.id: |
| 205 assigned = node.value | 212 assigned = node.value |
| 206 elif isinstance(target, ast.Tuple): | 213 elif isinstance(target, ast.Tuple): |
| 207 pos = 0 | 214 for pos, name in enumerate(target.elts): |
| 208 for name in target.elts: | |
| 209 if name.id == self.__varName.id: | 215 if name.id == self.__varName.id: |
| 210 assigned = node.value.elts[pos] | 216 assigned = node.value.elts[pos] |
| 211 break | 217 break |
| 212 pos += 1 | |
| 213 | 218 |
| 214 return assigned | 219 return assigned |
| 215 | 220 |
| 216 | 221 |
| 217 def evaluateVar(xssVar, parent, until, ignoreNodes=None): | 222 def evaluateVar(xssVar, parent, until, ignoreNodes=None): |
| 229 @return flag indicating a secure evaluation | 234 @return flag indicating a secure evaluation |
| 230 @rtype bool | 235 @rtype bool |
| 231 """ | 236 """ |
| 232 secure = False | 237 secure = False |
| 233 if isinstance(xssVar, ast.Name): | 238 if isinstance(xssVar, ast.Name): |
| 234 if isinstance(parent, ast.FunctionDef): | 239 if ( |
| 235 for name in parent.args.args: | 240 isinstance(parent, ast.FunctionDef) and |
| 236 if name.arg == xssVar.id: | 241 any(name.arg == xssVar.id for name in parent.args.args) |
| 237 return False # Params are not secure | 242 ): |
| 243 return False # Params are not secure | |
| 238 | 244 |
| 239 analyser = DeepAssignation(xssVar, ignoreNodes) | 245 analyser = DeepAssignation(xssVar, ignoreNodes) |
| 240 for node in parent.body: | 246 for node in parent.body: |
| 241 if node.lineno >= until: | 247 if node.lineno >= until: |
| 242 break | 248 break |
| 288 @rtype bool | 294 @rtype bool |
| 289 """ | 295 """ |
| 290 secure = False | 296 secure = False |
| 291 evaluate = False | 297 evaluate = False |
| 292 | 298 |
| 293 if isinstance(call, ast.Call) and isinstance(call.func, ast.Attribute): | 299 if ( |
| 294 if ( | 300 isinstance(call, ast.Call) and |
| 295 AstUtilities.isString(call.func.value) and | 301 isinstance(call.func, ast.Attribute) and |
| 296 call.func.attr == 'format' | 302 AstUtilities.isString(call.func.value) and |
| 297 ): | 303 call.func.attr == 'format' |
| 298 evaluate = True | 304 ): |
| 299 if call.keywords: | 305 evaluate = True |
| 300 evaluate = False | 306 if call.keywords: |
| 307 evaluate = False | |
| 301 | 308 |
| 302 if evaluate: | 309 if evaluate: |
| 303 args = list(call.args) | 310 args = list(call.args) |
| 304 | 311 |
| 305 numSecure = 0 | 312 numSecure = 0 |
