Class TestNewTaintSources

tests/unit/test_taint_engine_extension.py:234–265

# ===========================================================================

class TestNewTaintSources:

    def test_input_to_getattr(self):
        """input() → attr → getattr() must fire (TS006 source)."""
        code = """
            attr = input('Enter attribute: ')
            value = getattr(obj, attr)
        """
        assert findings_for(code, "GETATTR828"), \
            "GETATTR828 must fire when attr comes from input()"

    def test_environ_to_open_no_finding(self):
        """os.environ.get() is now OperatorConfig — opening a path the operator
        set via environment variable is intentional, not a vulnerability."""
        code = """
            import os
            path = os.environ.get('CONFIG_PATH')
            with open(path) as f:
                data = f.read()
        """
        assert not findings_for(code, "OPEN1149"), \
            "OPEN1149 must NOT fire when path comes from os.environ.get() (operator-trusted)"

    def test_http_request_to_open_still_fires(self):
        """HTTP request parameter → open() must still fire (attacker-controlled)."""
        code = """
            path = request.GET.get('file')
            with open(path) as f:
                data = f.read()
        """
        assert findings_for(code, "OPEN1149"), \
            "OPEN1149 must still fire when path comes from HTTP request"


# ===========================================================================