| 56 | # ============================================================ |
| 57 | |
| 58 | class TestSSTI001: |
| 59 | def test_render_template_string_tainted_fires(self): |
| 60 | code = """ |
| 61 | tmpl = request.GET.get('template') |
| 62 | return render_template_string(tmpl) |
| 63 | """ |
| 64 | assert fires(code, "SSTI001"), "SSTI001 must fire: tainted string to render_template_string" |
| 65 | |
| 66 | def test_from_string_silent_removed(self): |
| 67 | # SK_SSTI002 (from_string sink) removed — from_string() is too generic. |
| 68 | # It fired on TF's DeviceSpec.from_string(), any library with .from_string(). |
| 69 | # SSTI is still caught via render_template_string (SK_SSTI001) and |
| 70 | # the jinja2.Template pattern-based rule. |
| 71 | code = """ |
| 72 | src = request.POST.get('src') |
| 73 | result = env.from_string(src).render() |
| 74 | """ |
| 75 | assert not_fires(code, "SSTI001"), "SK_SSTI002 removed: from_string too generic" |
| 76 | |
| 77 | def test_static_template_safe(self): |
| 78 | code = """ |
| 79 | result = render_template_string('<h1>Hello {{ name }}</h1>', name=user) |
| 80 | """ |
| 81 | assert not_fires(code, "SSTI001"), "SSTI001 must NOT fire for static template literal" |
| 82 | |
| 83 | |
| 84 | # ============================================================ |
nothing calls this directly
no outgoing calls
no test coverage detected