Mercurial Repositories > eric / file comparison
comparison: eric6/Plugins/CheckerPlugins/CodeStyleChecker/Security/Checks/djangoXssVulnerability.py
eric6/Plugins/CheckerPlugins/CodeStyleChecker/Security/Checks/djangoXssVulnerability.py
- changeset 7637
- c878e8255972
- parent 7622
- 384e2aa5c073
- child 7923
- 91e843545d9a
equal
deleted
inserted
replaced
| 7636:61566f35ab22 | 7637:c878e8255972 |
|---|---|
| 14 # | 14 # |
| 15 # SPDX-License-Identifier: Apache-2.0 | 15 # SPDX-License-Identifier: Apache-2.0 |
| 16 # | 16 # |
| 17 | 17 |
| 18 import ast | 18 import ast |
| 19 import sys | |
| 20 | 19 |
| 21 import AstUtilities | 20 import AstUtilities |
| 22 | |
| 23 PY2 = sys.version_info[0] == 2 | |
| 24 | 21 |
| 25 | 22 |
| 26 def getChecks(): | 23 def getChecks(): |
| 27 """ | 24 """ |
| 28 Public method to get a dictionary with checks handled by this module. | 25 Public method to get a dictionary with checks handled by this module. |
| 83 parent = parent._securityParent | 80 parent = parent._securityParent |
| 84 | 81 |
| 85 isParam = False | 82 isParam = False |
| 86 if isinstance(parent, ast.FunctionDef): | 83 if isinstance(parent, ast.FunctionDef): |
| 87 for name in parent.args.args: | 84 for name in parent.args.args: |
| 88 argName = name.id if PY2 else name.arg | 85 if name.arg == xssVar.id: |
| 89 if argName == xssVar.id: | |
| 90 isParam = True | 86 isParam = True |
| 91 break | 87 break |
| 92 | 88 |
| 93 if not isParam: | 89 if not isParam: |
| 94 secure = evaluateVar(xssVar, parent, node.lineno) | 90 secure = evaluateVar(xssVar, parent, node.lineno) |
| 177 # If is param the assignations are not affected | 173 # If is param the assignations are not affected |
| 178 return assigned | 174 return assigned |
| 179 | 175 |
| 180 assigned = self.isAssignedIn(node.body) | 176 assigned = self.isAssignedIn(node.body) |
| 181 elif isinstance(node, ast.With): | 177 elif isinstance(node, ast.With): |
| 182 if PY2: | 178 for withitem in node.items: |
| 183 if node.optional_vars.id == self.__varName.id: | 179 varId = getattr(withitem.optional_vars, 'id', None) |
| 180 if varId == self.__varName.id: | |
| 184 assigned = node | 181 assigned = node |
| 185 else: | 182 else: |
| 186 assigned = self.isAssignedIn(node.body) | 183 assigned = self.isAssignedIn(node.body) |
| 187 else: | 184 elif isinstance(node, ast.Try): |
| 188 for withitem in node.items: | |
| 189 varId = getattr(withitem.optional_vars, 'id', None) | |
| 190 if varId == self.__varName.id: | |
| 191 assigned = node | |
| 192 else: | |
| 193 assigned = self.isAssignedIn(node.body) | |
| 194 elif PY2 and isinstance(node, ast.TryFinally): | |
| 195 assigned = [] | |
| 196 assigned.extend(self.isAssignedIn(node.body)) | |
| 197 assigned.extend(self.isAssignedIn(node.finalbody)) | |
| 198 elif PY2 and isinstance(node, ast.TryExcept): | |
| 199 assigned = [] | |
| 200 assigned.extend(self.isAssignedIn(node.body)) | |
| 201 assigned.extend(self.isAssignedIn(node.handlers)) | |
| 202 assigned.extend(self.isAssignedIn(node.orelse)) | |
| 203 elif not PY2 and isinstance(node, ast.Try): | |
| 204 assigned = [] | 185 assigned = [] |
| 205 assigned.extend(self.isAssignedIn(node.body)) | 186 assigned.extend(self.isAssignedIn(node.body)) |
| 206 assigned.extend(self.isAssignedIn(node.handlers)) | 187 assigned.extend(self.isAssignedIn(node.handlers)) |
| 207 assigned.extend(self.isAssignedIn(node.orelse)) | 188 assigned.extend(self.isAssignedIn(node.orelse)) |
| 208 assigned.extend(self.isAssignedIn(node.finalbody)) | 189 assigned.extend(self.isAssignedIn(node.finalbody)) |
| 250 """ | 231 """ |
| 251 secure = False | 232 secure = False |
| 252 if isinstance(xssVar, ast.Name): | 233 if isinstance(xssVar, ast.Name): |
| 253 if isinstance(parent, ast.FunctionDef): | 234 if isinstance(parent, ast.FunctionDef): |
| 254 for name in parent.args.args: | 235 for name in parent.args.args: |
| 255 argName = name.id if PY2 else name.arg | 236 if name.arg == xssVar.id: |
| 256 if argName == xssVar.id: | |
| 257 return False # Params are not secure | 237 return False # Params are not secure |
| 258 | 238 |
| 259 analyser = DeepAssignation(xssVar, ignoreNodes) | 239 analyser = DeepAssignation(xssVar, ignoreNodes) |
| 260 for node in parent.body: | 240 for node in parent.body: |
| 261 if node.lineno >= until: | 241 if node.lineno >= until: |
| 314 if ( | 294 if ( |
| 315 AstUtilities.isString(call.func.value) and | 295 AstUtilities.isString(call.func.value) and |
| 316 call.func.attr == 'format' | 296 call.func.attr == 'format' |
| 317 ): | 297 ): |
| 318 evaluate = True | 298 evaluate = True |
| 319 if call.keywords or (PY2 and call.kwargs): | 299 if call.keywords: |
| 320 evaluate = False | 300 evaluate = False |
| 321 | 301 |
| 322 if evaluate: | 302 if evaluate: |
| 323 args = list(call.args) | 303 args = list(call.args) |
| 324 if ( | |
| 325 PY2 and | |
| 326 call.starargs and | |
| 327 isinstance(call.starargs, (ast.List, ast.Tuple)) | |
| 328 ): | |
| 329 args.extend(call.starargs.elts) | |
| 330 | 304 |
| 331 numSecure = 0 | 305 numSecure = 0 |
| 332 for arg in args: | 306 for arg in args: |
| 333 if AstUtilities.isString(arg): | 307 if AstUtilities.isString(arg): |
| 334 numSecure += 1 | 308 numSecure += 1 |
| 341 if evaluateCall(arg, parent, ignoreNodes): | 315 if evaluateCall(arg, parent, ignoreNodes): |
| 342 numSecure += 1 | 316 numSecure += 1 |
| 343 else: | 317 else: |
| 344 break | 318 break |
| 345 elif ( | 319 elif ( |
| 346 not PY2 and | |
| 347 isinstance(arg, ast.Starred) and | 320 isinstance(arg, ast.Starred) and |
| 348 isinstance(arg.value, (ast.List, ast.Tuple)) | 321 isinstance(arg.value, (ast.List, ast.Tuple)) |
| 349 ): | 322 ): |
| 350 args.extend(arg.value.elts) | 323 args.extend(arg.value.elts) |
| 351 numSecure += 1 | 324 numSecure += 1 |
| 370 isLeftStr = AstUtilities.isString(var.left) | 343 isLeftStr = AstUtilities.isString(var.left) |
| 371 if isMod and isLeftStr: | 344 if isMod and isLeftStr: |
| 372 newCall = ast.Call() | 345 newCall = ast.Call() |
| 373 newCall.args = [] | 346 newCall.args = [] |
| 374 newCall.args = [] | 347 newCall.args = [] |
| 375 if PY2: | |
| 376 newCall.starargs = None | |
| 377 newCall.keywords = None | 348 newCall.keywords = None |
| 378 if PY2: | |
| 379 newCall.kwargs = None | |
| 380 newCall.lineno = var.lineno | 349 newCall.lineno = var.lineno |
| 381 newCall.func = ast.Attribute() | 350 newCall.func = ast.Attribute() |
| 382 newCall.func.value = var.left | 351 newCall.func.value = var.left |
| 383 newCall.func.attr = 'format' | 352 newCall.func.attr = 'format' |
| 384 if isinstance(var.right, ast.Tuple): | 353 if isinstance(var.right, ast.Tuple): |
| 385 newCall.args = var.right.elts | 354 newCall.args = var.right.elts |
| 386 elif PY2 and isinstance(var.right, ast.Dict): | |
| 387 newCall.kwargs = var.right | |
| 388 else: | 355 else: |
| 389 newCall.args = [var.right] | 356 newCall.args = [var.right] |
| 390 | 357 |
| 391 return newCall | 358 return newCall |
| 392 | 359 |
