Mercurial Repositories > eric / file comparison
comparison: eric7/Documentation/Source/eric7.Plugins.CheckerPlugins.CodeStyleChecker.Security.Checks.djangoXssVulnerability.html
eric7/Documentation/Source/eric7.Plugins.CheckerPlugins.CodeStyleChecker.Security.Checks.djangoXssVulnerability.html
- branch
- eric7
- changeset 8372
- e0227a7c850e
- child 8596
- d64760b2da50
equal
deleted
inserted
replaced
| 8371:d6062691d424 | 8372:e0227a7c850e |
|---|---|
| 1 <!DOCTYPE html> | |
| 2 <html><head> | |
| 3 <title>eric7.Plugins.CheckerPlugins.CodeStyleChecker.Security.Checks.djangoXssVulnerability</title> | |
| 4 <meta charset="UTF-8"> | |
| 5 <style> | |
| 6 body { | |
| 7 background: #EDECE6; | |
| 8 margin: 0em 1em 10em 1em; | |
| 9 color: black; | |
| 10 } | |
| 11 | |
| 12 h1 { color: white; background: #85774A; } | |
| 13 h2 { color: white; background: #85774A; } | |
| 14 h3 { color: white; background: #9D936E; } | |
| 15 h4 { color: white; background: #9D936E; } | |
| 16 | |
| 17 a { color: #BA6D36; } | |
| 18 | |
| 19 </style> | |
| 20 </head> | |
| 21 <body> | |
| 22 <a NAME="top" ID="top"></a> | |
| 23 <h1>eric7.Plugins.CheckerPlugins.CodeStyleChecker.Security.Checks.djangoXssVulnerability</h1> | |
| 24 | |
| 25 <p> | |
| 26 Module implementing checks for potential XSS vulnerability. | |
| 27 </p> | |
| 28 <h3>Global Attributes</h3> | |
| 29 | |
| 30 <table> | |
| 31 <tr><td>None</td></tr> | |
| 32 </table> | |
| 33 <h3>Classes</h3> | |
| 34 | |
| 35 <table> | |
| 36 | |
| 37 <tr> | |
| 38 <td><a href="#DeepAssignation">DeepAssignation</a></td> | |
| 39 <td>Class to perform a deep analysis of an assign.</td> | |
| 40 </tr> | |
| 41 </table> | |
| 42 <h3>Functions</h3> | |
| 43 | |
| 44 <table> | |
| 45 | |
| 46 <tr> | |
| 47 <td><a href="#checkDjangoXssVulnerability">checkDjangoXssVulnerability</a></td> | |
| 48 <td>Function to check for potential XSS vulnerability.</td> | |
| 49 </tr> | |
| 50 <tr> | |
| 51 <td><a href="#checkPotentialRisk">checkPotentialRisk</a></td> | |
| 52 <td>Function to check a given node for a potential XSS vulnerability.</td> | |
| 53 </tr> | |
| 54 <tr> | |
| 55 <td><a href="#evaluateCall">evaluateCall</a></td> | |
| 56 <td>Function to evaluate a call node for potential XSS vulnerability.</td> | |
| 57 </tr> | |
| 58 <tr> | |
| 59 <td><a href="#evaluateVar">evaluateVar</a></td> | |
| 60 <td>Function to evaluate a variable node for potential XSS vulnerability.</td> | |
| 61 </tr> | |
| 62 <tr> | |
| 63 <td><a href="#getChecks">getChecks</a></td> | |
| 64 <td>Public method to get a dictionary with checks handled by this module.</td> | |
| 65 </tr> | |
| 66 <tr> | |
| 67 <td><a href="#transform2call">transform2call</a></td> | |
| 68 <td>Function to transform a variable node to a call node.</td> | |
| 69 </tr> | |
| 70 </table> | |
| 71 <hr /> | |
| 72 <hr /> | |
| 73 <a NAME="DeepAssignation" ID="DeepAssignation"></a> | |
| 74 <h2>DeepAssignation</h2> | |
| 75 | |
| 76 <p> | |
| 77 Class to perform a deep analysis of an assign. | |
| 78 </p> | |
| 79 <h3>Derived from</h3> | |
| 80 None | |
| 81 <h3>Class Attributes</h3> | |
| 82 | |
| 83 <table> | |
| 84 <tr><td>None</td></tr> | |
| 85 </table> | |
| 86 <h3>Class Methods</h3> | |
| 87 | |
| 88 <table> | |
| 89 <tr><td>None</td></tr> | |
| 90 </table> | |
| 91 <h3>Methods</h3> | |
| 92 | |
| 93 <table> | |
| 94 | |
| 95 <tr> | |
| 96 <td><a href="#DeepAssignation.__init__">DeepAssignation</a></td> | |
| 97 <td>Constructor</td> | |
| 98 </tr> | |
| 99 <tr> | |
| 100 <td><a href="#DeepAssignation.isAssigned">isAssigned</a></td> | |
| 101 <td>Public method to check assignment against a given node.</td> | |
| 102 </tr> | |
| 103 <tr> | |
| 104 <td><a href="#DeepAssignation.isAssignedIn">isAssignedIn</a></td> | |
| 105 <td>Public method to check, if the variable is assigned to.</td> | |
| 106 </tr> | |
| 107 </table> | |
| 108 <h3>Static Methods</h3> | |
| 109 | |
| 110 <table> | |
| 111 <tr><td>None</td></tr> | |
| 112 </table> | |
| 113 | |
| 114 <a NAME="DeepAssignation.__init__" ID="DeepAssignation.__init__"></a> | |
| 115 <h4>DeepAssignation (Constructor)</h4> | |
| 116 <b>DeepAssignation</b>(<i>varName, ignoreNodes=None</i>) | |
| 117 | |
| 118 <p> | |
| 119 Constructor | |
| 120 </p> | |
| 121 <dl> | |
| 122 | |
| 123 <dt><i>varName</i> (str)</dt> | |
| 124 <dd> | |
| 125 name of the variable | |
| 126 </dd> | |
| 127 <dt><i>ignoreNodes</i> (list of ast.AST)</dt> | |
| 128 <dd> | |
| 129 list of nodes to ignore | |
| 130 </dd> | |
| 131 </dl> | |
| 132 <a NAME="DeepAssignation.isAssigned" ID="DeepAssignation.isAssigned"></a> | |
| 133 <h4>DeepAssignation.isAssigned</h4> | |
| 134 <b>isAssigned</b>(<i>node</i>) | |
| 135 | |
| 136 <p> | |
| 137 Public method to check assignment against a given node. | |
| 138 </p> | |
| 139 <dl> | |
| 140 | |
| 141 <dt><i>node</i> (ast.AST)</dt> | |
| 142 <dd> | |
| 143 node to check against | |
| 144 </dd> | |
| 145 </dl> | |
| 146 <dl> | |
| 147 <dt>Return:</dt> | |
| 148 <dd> | |
| 149 flag indicating an assignement | |
| 150 </dd> | |
| 151 </dl> | |
| 152 <dl> | |
| 153 <dt>Return Type:</dt> | |
| 154 <dd> | |
| 155 bool | |
| 156 </dd> | |
| 157 </dl> | |
| 158 <a NAME="DeepAssignation.isAssignedIn" ID="DeepAssignation.isAssignedIn"></a> | |
| 159 <h4>DeepAssignation.isAssignedIn</h4> | |
| 160 <b>isAssignedIn</b>(<i>items</i>) | |
| 161 | |
| 162 <p> | |
| 163 Public method to check, if the variable is assigned to. | |
| 164 </p> | |
| 165 <dl> | |
| 166 | |
| 167 <dt><i>items</i> (list of ast.AST)</dt> | |
| 168 <dd> | |
| 169 list of nodes to check against | |
| 170 </dd> | |
| 171 </dl> | |
| 172 <dl> | |
| 173 <dt>Return:</dt> | |
| 174 <dd> | |
| 175 list of nodes assigned | |
| 176 </dd> | |
| 177 </dl> | |
| 178 <dl> | |
| 179 <dt>Return Type:</dt> | |
| 180 <dd> | |
| 181 list of ast.AST | |
| 182 </dd> | |
| 183 </dl> | |
| 184 <div align="right"><a href="#top">Up</a></div> | |
| 185 <hr /> | |
| 186 <hr /> | |
| 187 <a NAME="checkDjangoXssVulnerability" ID="checkDjangoXssVulnerability"></a> | |
| 188 <h2>checkDjangoXssVulnerability</h2> | |
| 189 <b>checkDjangoXssVulnerability</b>(<i>reportError, context, config</i>) | |
| 190 | |
| 191 <p> | |
| 192 Function to check for potential XSS vulnerability. | |
| 193 </p> | |
| 194 <dl> | |
| 195 | |
| 196 <dt><i>reportError</i> (func)</dt> | |
| 197 <dd> | |
| 198 function to be used to report errors | |
| 199 </dd> | |
| 200 <dt><i>context</i> (SecurityContext)</dt> | |
| 201 <dd> | |
| 202 security context object | |
| 203 </dd> | |
| 204 <dt><i>config</i> (dict)</dt> | |
| 205 <dd> | |
| 206 dictionary with configuration data | |
| 207 </dd> | |
| 208 </dl> | |
| 209 <div align="right"><a href="#top">Up</a></div> | |
| 210 <hr /> | |
| 211 <hr /> | |
| 212 <a NAME="checkPotentialRisk" ID="checkPotentialRisk"></a> | |
| 213 <h2>checkPotentialRisk</h2> | |
| 214 <b>checkPotentialRisk</b>(<i>reportError, node</i>) | |
| 215 | |
| 216 <p> | |
| 217 Function to check a given node for a potential XSS vulnerability. | |
| 218 </p> | |
| 219 <dl> | |
| 220 | |
| 221 <dt><i>reportError</i> (func)</dt> | |
| 222 <dd> | |
| 223 function to be used to report errors | |
| 224 </dd> | |
| 225 <dt><i>node</i> (ast.Call)</dt> | |
| 226 <dd> | |
| 227 node to be checked | |
| 228 </dd> | |
| 229 </dl> | |
| 230 <div align="right"><a href="#top">Up</a></div> | |
| 231 <hr /> | |
| 232 <hr /> | |
| 233 <a NAME="evaluateCall" ID="evaluateCall"></a> | |
| 234 <h2>evaluateCall</h2> | |
| 235 <b>evaluateCall</b>(<i>call, parent, ignoreNodes=None</i>) | |
| 236 | |
| 237 <p> | |
| 238 Function to evaluate a call node for potential XSS vulnerability. | |
| 239 </p> | |
| 240 <dl> | |
| 241 | |
| 242 <dt><i>call</i> (ast.Call)</dt> | |
| 243 <dd> | |
| 244 call node to be checked | |
| 245 </dd> | |
| 246 <dt><i>parent</i> (ast.AST)</dt> | |
| 247 <dd> | |
| 248 parent node | |
| 249 </dd> | |
| 250 <dt><i>ignoreNodes</i> (list of ast.AST)</dt> | |
| 251 <dd> | |
| 252 list of nodes to ignore | |
| 253 </dd> | |
| 254 </dl> | |
| 255 <dl> | |
| 256 <dt>Return:</dt> | |
| 257 <dd> | |
| 258 flag indicating a secure evaluation | |
| 259 </dd> | |
| 260 </dl> | |
| 261 <dl> | |
| 262 <dt>Return Type:</dt> | |
| 263 <dd> | |
| 264 bool | |
| 265 </dd> | |
| 266 </dl> | |
| 267 <div align="right"><a href="#top">Up</a></div> | |
| 268 <hr /> | |
| 269 <hr /> | |
| 270 <a NAME="evaluateVar" ID="evaluateVar"></a> | |
| 271 <h2>evaluateVar</h2> | |
| 272 <b>evaluateVar</b>(<i>xssVar, parent, until, ignoreNodes=None</i>) | |
| 273 | |
| 274 <p> | |
| 275 Function to evaluate a variable node for potential XSS vulnerability. | |
| 276 </p> | |
| 277 <dl> | |
| 278 | |
| 279 <dt><i>xssVar</i> (ast.Name)</dt> | |
| 280 <dd> | |
| 281 variable node to be checked | |
| 282 </dd> | |
| 283 <dt><i>parent</i> (ast.AST)</dt> | |
| 284 <dd> | |
| 285 parent node | |
| 286 </dd> | |
| 287 <dt><i>until</i> (int)</dt> | |
| 288 <dd> | |
| 289 end line number to evaluate variable against | |
| 290 </dd> | |
| 291 <dt><i>ignoreNodes</i> (list of ast.AST)</dt> | |
| 292 <dd> | |
| 293 list of nodes to ignore | |
| 294 </dd> | |
| 295 </dl> | |
| 296 <dl> | |
| 297 <dt>Return:</dt> | |
| 298 <dd> | |
| 299 flag indicating a secure evaluation | |
| 300 </dd> | |
| 301 </dl> | |
| 302 <dl> | |
| 303 <dt>Return Type:</dt> | |
| 304 <dd> | |
| 305 bool | |
| 306 </dd> | |
| 307 </dl> | |
| 308 <div align="right"><a href="#top">Up</a></div> | |
| 309 <hr /> | |
| 310 <hr /> | |
| 311 <a NAME="getChecks" ID="getChecks"></a> | |
| 312 <h2>getChecks</h2> | |
| 313 <b>getChecks</b>(<i></i>) | |
| 314 | |
| 315 <p> | |
| 316 Public method to get a dictionary with checks handled by this module. | |
| 317 </p> | |
| 318 <dl> | |
| 319 <dt>Return:</dt> | |
| 320 <dd> | |
| 321 dictionary containing checker lists containing checker function and | |
| 322 list of codes | |
| 323 </dd> | |
| 324 </dl> | |
| 325 <dl> | |
| 326 <dt>Return Type:</dt> | |
| 327 <dd> | |
| 328 dict | |
| 329 </dd> | |
| 330 </dl> | |
| 331 <div align="right"><a href="#top">Up</a></div> | |
| 332 <hr /> | |
| 333 <hr /> | |
| 334 <a NAME="transform2call" ID="transform2call"></a> | |
| 335 <h2>transform2call</h2> | |
| 336 <b>transform2call</b>(<i>var</i>) | |
| 337 | |
| 338 <p> | |
| 339 Function to transform a variable node to a call node. | |
| 340 </p> | |
| 341 <dl> | |
| 342 | |
| 343 <dt><i>var</i> (ast.BinOp)</dt> | |
| 344 <dd> | |
| 345 variable node | |
| 346 </dd> | |
| 347 </dl> | |
| 348 <dl> | |
| 349 <dt>Return:</dt> | |
| 350 <dd> | |
| 351 call node | |
| 352 </dd> | |
| 353 </dl> | |
| 354 <dl> | |
| 355 <dt>Return Type:</dt> | |
| 356 <dd> | |
| 357 ast.Call | |
| 358 </dd> | |
| 359 </dl> | |
| 360 <div align="right"><a href="#top">Up</a></div> | |
| 361 <hr /> | |
| 362 </body></html> |
