Mercurial Repositories > eric / file comparison
comparison: src/eric7/Documentation/Source/eric7.Plugins.CheckerPlugins.CodeStyleChecker.Security.Checks.djangoXssVulnerability.html
src/eric7/Documentation/Source/eric7.Plugins.CheckerPlugins.CodeStyleChecker.Security.Checks.djangoXssVulnerability.html
- branch
- eric7
- changeset 9209
- b99e7fd55fd3
- parent 8596
- d64760b2da50
- child 10070
- 9f5758c0fec1
equal
deleted
inserted
replaced
| 9208:3fc8dfeb6ebe | 9209:b99e7fd55fd3 |
|---|---|
| 1 <!DOCTYPE html> | |
| 2 <html><head> | |
| 3 <title>eric7.Plugins.CheckerPlugins.CodeStyleChecker.Security.Checks.djangoXssVulnerability</title> | |
| 4 <meta charset="UTF-8"> | |
| 5 <link rel="stylesheet" href="styles.css"> | |
| 6 </head> | |
| 7 <body> | |
| 8 <a NAME="top" ID="top"></a> | |
| 9 <h1>eric7.Plugins.CheckerPlugins.CodeStyleChecker.Security.Checks.djangoXssVulnerability</h1> | |
| 10 | |
| 11 <p> | |
| 12 Module implementing checks for potential XSS vulnerability. | |
| 13 </p> | |
| 14 <h3>Global Attributes</h3> | |
| 15 | |
| 16 <table> | |
| 17 <tr><td>None</td></tr> | |
| 18 </table> | |
| 19 <h3>Classes</h3> | |
| 20 | |
| 21 <table> | |
| 22 | |
| 23 <tr> | |
| 24 <td><a href="#DeepAssignation">DeepAssignation</a></td> | |
| 25 <td>Class to perform a deep analysis of an assign.</td> | |
| 26 </tr> | |
| 27 </table> | |
| 28 <h3>Functions</h3> | |
| 29 | |
| 30 <table> | |
| 31 | |
| 32 <tr> | |
| 33 <td><a href="#checkDjangoXssVulnerability">checkDjangoXssVulnerability</a></td> | |
| 34 <td>Function to check for potential XSS vulnerability.</td> | |
| 35 </tr> | |
| 36 <tr> | |
| 37 <td><a href="#checkPotentialRisk">checkPotentialRisk</a></td> | |
| 38 <td>Function to check a given node for a potential XSS vulnerability.</td> | |
| 39 </tr> | |
| 40 <tr> | |
| 41 <td><a href="#evaluateCall">evaluateCall</a></td> | |
| 42 <td>Function to evaluate a call node for potential XSS vulnerability.</td> | |
| 43 </tr> | |
| 44 <tr> | |
| 45 <td><a href="#evaluateVar">evaluateVar</a></td> | |
| 46 <td>Function to evaluate a variable node for potential XSS vulnerability.</td> | |
| 47 </tr> | |
| 48 <tr> | |
| 49 <td><a href="#getChecks">getChecks</a></td> | |
| 50 <td>Public method to get a dictionary with checks handled by this module.</td> | |
| 51 </tr> | |
| 52 <tr> | |
| 53 <td><a href="#transform2call">transform2call</a></td> | |
| 54 <td>Function to transform a variable node to a call node.</td> | |
| 55 </tr> | |
| 56 </table> | |
| 57 <hr /> | |
| 58 <hr /> | |
| 59 <a NAME="DeepAssignation" ID="DeepAssignation"></a> | |
| 60 <h2>DeepAssignation</h2> | |
| 61 | |
| 62 <p> | |
| 63 Class to perform a deep analysis of an assign. | |
| 64 </p> | |
| 65 <h3>Derived from</h3> | |
| 66 None | |
| 67 <h3>Class Attributes</h3> | |
| 68 | |
| 69 <table> | |
| 70 <tr><td>None</td></tr> | |
| 71 </table> | |
| 72 <h3>Class Methods</h3> | |
| 73 | |
| 74 <table> | |
| 75 <tr><td>None</td></tr> | |
| 76 </table> | |
| 77 <h3>Methods</h3> | |
| 78 | |
| 79 <table> | |
| 80 | |
| 81 <tr> | |
| 82 <td><a href="#DeepAssignation.__init__">DeepAssignation</a></td> | |
| 83 <td>Constructor</td> | |
| 84 </tr> | |
| 85 <tr> | |
| 86 <td><a href="#DeepAssignation.isAssigned">isAssigned</a></td> | |
| 87 <td>Public method to check assignment against a given node.</td> | |
| 88 </tr> | |
| 89 <tr> | |
| 90 <td><a href="#DeepAssignation.isAssignedIn">isAssignedIn</a></td> | |
| 91 <td>Public method to check, if the variable is assigned to.</td> | |
| 92 </tr> | |
| 93 </table> | |
| 94 <h3>Static Methods</h3> | |
| 95 | |
| 96 <table> | |
| 97 <tr><td>None</td></tr> | |
| 98 </table> | |
| 99 | |
| 100 <a NAME="DeepAssignation.__init__" ID="DeepAssignation.__init__"></a> | |
| 101 <h4>DeepAssignation (Constructor)</h4> | |
| 102 <b>DeepAssignation</b>(<i>varName, ignoreNodes=None</i>) | |
| 103 | |
| 104 <p> | |
| 105 Constructor | |
| 106 </p> | |
| 107 <dl> | |
| 108 | |
| 109 <dt><i>varName</i> (str)</dt> | |
| 110 <dd> | |
| 111 name of the variable | |
| 112 </dd> | |
| 113 <dt><i>ignoreNodes</i> (list of ast.AST)</dt> | |
| 114 <dd> | |
| 115 list of nodes to ignore | |
| 116 </dd> | |
| 117 </dl> | |
| 118 <a NAME="DeepAssignation.isAssigned" ID="DeepAssignation.isAssigned"></a> | |
| 119 <h4>DeepAssignation.isAssigned</h4> | |
| 120 <b>isAssigned</b>(<i>node</i>) | |
| 121 | |
| 122 <p> | |
| 123 Public method to check assignment against a given node. | |
| 124 </p> | |
| 125 <dl> | |
| 126 | |
| 127 <dt><i>node</i> (ast.AST)</dt> | |
| 128 <dd> | |
| 129 node to check against | |
| 130 </dd> | |
| 131 </dl> | |
| 132 <dl> | |
| 133 <dt>Return:</dt> | |
| 134 <dd> | |
| 135 flag indicating an assignement | |
| 136 </dd> | |
| 137 </dl> | |
| 138 <dl> | |
| 139 <dt>Return Type:</dt> | |
| 140 <dd> | |
| 141 bool | |
| 142 </dd> | |
| 143 </dl> | |
| 144 <a NAME="DeepAssignation.isAssignedIn" ID="DeepAssignation.isAssignedIn"></a> | |
| 145 <h4>DeepAssignation.isAssignedIn</h4> | |
| 146 <b>isAssignedIn</b>(<i>items</i>) | |
| 147 | |
| 148 <p> | |
| 149 Public method to check, if the variable is assigned to. | |
| 150 </p> | |
| 151 <dl> | |
| 152 | |
| 153 <dt><i>items</i> (list of ast.AST)</dt> | |
| 154 <dd> | |
| 155 list of nodes to check against | |
| 156 </dd> | |
| 157 </dl> | |
| 158 <dl> | |
| 159 <dt>Return:</dt> | |
| 160 <dd> | |
| 161 list of nodes assigned | |
| 162 </dd> | |
| 163 </dl> | |
| 164 <dl> | |
| 165 <dt>Return Type:</dt> | |
| 166 <dd> | |
| 167 list of ast.AST | |
| 168 </dd> | |
| 169 </dl> | |
| 170 <div align="right"><a href="#top">Up</a></div> | |
| 171 <hr /> | |
| 172 <hr /> | |
| 173 <a NAME="checkDjangoXssVulnerability" ID="checkDjangoXssVulnerability"></a> | |
| 174 <h2>checkDjangoXssVulnerability</h2> | |
| 175 <b>checkDjangoXssVulnerability</b>(<i>reportError, context, config</i>) | |
| 176 | |
| 177 <p> | |
| 178 Function to check for potential XSS vulnerability. | |
| 179 </p> | |
| 180 <dl> | |
| 181 | |
| 182 <dt><i>reportError</i> (func)</dt> | |
| 183 <dd> | |
| 184 function to be used to report errors | |
| 185 </dd> | |
| 186 <dt><i>context</i> (SecurityContext)</dt> | |
| 187 <dd> | |
| 188 security context object | |
| 189 </dd> | |
| 190 <dt><i>config</i> (dict)</dt> | |
| 191 <dd> | |
| 192 dictionary with configuration data | |
| 193 </dd> | |
| 194 </dl> | |
| 195 <div align="right"><a href="#top">Up</a></div> | |
| 196 <hr /> | |
| 197 <hr /> | |
| 198 <a NAME="checkPotentialRisk" ID="checkPotentialRisk"></a> | |
| 199 <h2>checkPotentialRisk</h2> | |
| 200 <b>checkPotentialRisk</b>(<i>reportError, node</i>) | |
| 201 | |
| 202 <p> | |
| 203 Function to check a given node for a potential XSS vulnerability. | |
| 204 </p> | |
| 205 <dl> | |
| 206 | |
| 207 <dt><i>reportError</i> (func)</dt> | |
| 208 <dd> | |
| 209 function to be used to report errors | |
| 210 </dd> | |
| 211 <dt><i>node</i> (ast.Call)</dt> | |
| 212 <dd> | |
| 213 node to be checked | |
| 214 </dd> | |
| 215 </dl> | |
| 216 <div align="right"><a href="#top">Up</a></div> | |
| 217 <hr /> | |
| 218 <hr /> | |
| 219 <a NAME="evaluateCall" ID="evaluateCall"></a> | |
| 220 <h2>evaluateCall</h2> | |
| 221 <b>evaluateCall</b>(<i>call, parent, ignoreNodes=None</i>) | |
| 222 | |
| 223 <p> | |
| 224 Function to evaluate a call node for potential XSS vulnerability. | |
| 225 </p> | |
| 226 <dl> | |
| 227 | |
| 228 <dt><i>call</i> (ast.Call)</dt> | |
| 229 <dd> | |
| 230 call node to be checked | |
| 231 </dd> | |
| 232 <dt><i>parent</i> (ast.AST)</dt> | |
| 233 <dd> | |
| 234 parent node | |
| 235 </dd> | |
| 236 <dt><i>ignoreNodes</i> (list of ast.AST)</dt> | |
| 237 <dd> | |
| 238 list of nodes to ignore | |
| 239 </dd> | |
| 240 </dl> | |
| 241 <dl> | |
| 242 <dt>Return:</dt> | |
| 243 <dd> | |
| 244 flag indicating a secure evaluation | |
| 245 </dd> | |
| 246 </dl> | |
| 247 <dl> | |
| 248 <dt>Return Type:</dt> | |
| 249 <dd> | |
| 250 bool | |
| 251 </dd> | |
| 252 </dl> | |
| 253 <div align="right"><a href="#top">Up</a></div> | |
| 254 <hr /> | |
| 255 <hr /> | |
| 256 <a NAME="evaluateVar" ID="evaluateVar"></a> | |
| 257 <h2>evaluateVar</h2> | |
| 258 <b>evaluateVar</b>(<i>xssVar, parent, until, ignoreNodes=None</i>) | |
| 259 | |
| 260 <p> | |
| 261 Function to evaluate a variable node for potential XSS vulnerability. | |
| 262 </p> | |
| 263 <dl> | |
| 264 | |
| 265 <dt><i>xssVar</i> (ast.Name)</dt> | |
| 266 <dd> | |
| 267 variable node to be checked | |
| 268 </dd> | |
| 269 <dt><i>parent</i> (ast.AST)</dt> | |
| 270 <dd> | |
| 271 parent node | |
| 272 </dd> | |
| 273 <dt><i>until</i> (int)</dt> | |
| 274 <dd> | |
| 275 end line number to evaluate variable against | |
| 276 </dd> | |
| 277 <dt><i>ignoreNodes</i> (list of ast.AST)</dt> | |
| 278 <dd> | |
| 279 list of nodes to ignore | |
| 280 </dd> | |
| 281 </dl> | |
| 282 <dl> | |
| 283 <dt>Return:</dt> | |
| 284 <dd> | |
| 285 flag indicating a secure evaluation | |
| 286 </dd> | |
| 287 </dl> | |
| 288 <dl> | |
| 289 <dt>Return Type:</dt> | |
| 290 <dd> | |
| 291 bool | |
| 292 </dd> | |
| 293 </dl> | |
| 294 <div align="right"><a href="#top">Up</a></div> | |
| 295 <hr /> | |
| 296 <hr /> | |
| 297 <a NAME="getChecks" ID="getChecks"></a> | |
| 298 <h2>getChecks</h2> | |
| 299 <b>getChecks</b>(<i></i>) | |
| 300 | |
| 301 <p> | |
| 302 Public method to get a dictionary with checks handled by this module. | |
| 303 </p> | |
| 304 <dl> | |
| 305 <dt>Return:</dt> | |
| 306 <dd> | |
| 307 dictionary containing checker lists containing checker function and | |
| 308 list of codes | |
| 309 </dd> | |
| 310 </dl> | |
| 311 <dl> | |
| 312 <dt>Return Type:</dt> | |
| 313 <dd> | |
| 314 dict | |
| 315 </dd> | |
| 316 </dl> | |
| 317 <div align="right"><a href="#top">Up</a></div> | |
| 318 <hr /> | |
| 319 <hr /> | |
| 320 <a NAME="transform2call" ID="transform2call"></a> | |
| 321 <h2>transform2call</h2> | |
| 322 <b>transform2call</b>(<i>var</i>) | |
| 323 | |
| 324 <p> | |
| 325 Function to transform a variable node to a call node. | |
| 326 </p> | |
| 327 <dl> | |
| 328 | |
| 329 <dt><i>var</i> (ast.BinOp)</dt> | |
| 330 <dd> | |
| 331 variable node | |
| 332 </dd> | |
| 333 </dl> | |
| 334 <dl> | |
| 335 <dt>Return:</dt> | |
| 336 <dd> | |
| 337 call node | |
| 338 </dd> | |
| 339 </dl> | |
| 340 <dl> | |
| 341 <dt>Return Type:</dt> | |
| 342 <dd> | |
| 343 ast.Call | |
| 344 </dd> | |
| 345 </dl> | |
| 346 <div align="right"><a href="#top">Up</a></div> | |
| 347 <hr /> | |
| 348 </body></html> |
