| 64 | # =========================================================================== |
| 65 | |
| 66 | class TestGetattr828: |
| 67 | |
| 68 | def test_tainted_attr_via_request_get(self): |
| 69 | """request.get() → attr → getattr(obj, attr) must fire.""" |
| 70 | code = """ |
| 71 | attr = request.get('field') |
| 72 | value = getattr(user, attr) |
| 73 | """ |
| 74 | assert findings_for(code, "GETATTR828"), \ |
| 75 | "GETATTR828 must fire: tainted attr flows to getattr() second argument" |
| 76 | |
| 77 | def test_tainted_attr_via_django_GET(self): |
| 78 | """request.GET.get() → attr → getattr() must fire (Phase 1 new source).""" |
| 79 | code = """ |
| 80 | attr = request.GET.get('field') |
| 81 | value = getattr(user, attr) |
| 82 | """ |
| 83 | assert findings_for(code, "GETATTR828"), \ |
| 84 | "GETATTR828 must fire with Django request.GET.get() as source" |
| 85 | |
| 86 | def test_tainted_attr_via_django_POST(self): |
| 87 | """request.POST.get() as source.""" |
| 88 | code = """ |
| 89 | field_name = request.POST.get('attr') |
| 90 | result = getattr(model_instance, field_name) |
| 91 | """ |
| 92 | assert findings_for(code, "GETATTR828"), \ |
| 93 | "GETATTR828 must fire with request.POST.get() as source" |
| 94 | |
| 95 | def test_tainted_attr_via_flask_args(self): |
| 96 | """Flask request.args.get() as source.""" |
| 97 | code = """ |
| 98 | attr = request.args.get('property') |
| 99 | val = getattr(obj, attr) |
| 100 | """ |
| 101 | assert findings_for(code, "GETATTR828"), \ |
| 102 | "GETATTR828 must fire with Flask request.args.get() as source" |
| 103 | |
| 104 | def test_tainted_attr_via_subscript_django(self): |
| 105 | """Phase 2: request.GET['key'] subscript as source.""" |
| 106 | code = """ |
| 107 | attr = request.GET['field'] |
| 108 | value = getattr(user, attr) |
| 109 | """ |
| 110 | assert findings_for(code, "GETATTR828"), \ |
| 111 | "GETATTR828 must fire when attr comes from request.GET['key'] subscript" |
| 112 | |
| 113 | def test_tainted_attr_via_subscript_flask(self): |
| 114 | """Phase 2: request.args subscript as source.""" |
| 115 | code = """ |
| 116 | attr = request.args['property'] |
| 117 | val = getattr(obj, attr) |
| 118 | """ |
| 119 | assert findings_for(code, "GETATTR828"), \ |
| 120 | "GETATTR828 must fire when attr comes from request.args['key'] subscript" |
| 121 | |
| 122 | def test_tainted_attr_propagation_through_variable(self): |
| 123 | """Taint must propagate through intermediate variables.""" |
nothing calls this directly
no outgoing calls
no test coverage detected