| 155 | # =========================================================================== |
| 156 | |
| 157 | class TestOpen1149: |
| 158 | |
| 159 | def test_tainted_path_via_request_get(self): |
| 160 | """request.get() → path → open(path) must fire.""" |
| 161 | code = """ |
| 162 | filename = request.get('file') |
| 163 | with open(filename) as f: |
| 164 | data = f.read() |
| 165 | """ |
| 166 | assert findings_for(code, "OPEN1149"), \ |
| 167 | "OPEN1149 must fire when file path comes from request" |
| 168 | |
| 169 | def test_tainted_path_via_django_GET_subscript(self): |
| 170 | """Phase 2: request.GET['file'] subscript → open().""" |
| 171 | code = """ |
| 172 | path = request.GET['filename'] |
| 173 | with open(path, 'r') as f: |
| 174 | content = f.read() |
| 175 | """ |
| 176 | assert findings_for(code, "OPEN1149"), \ |
| 177 | "OPEN1149 must fire when path comes from request.GET subscript" |
| 178 | |
| 179 | def test_tainted_path_via_flask_form(self): |
| 180 | """Flask request.form.get() → open().""" |
| 181 | code = """ |
| 182 | upload_path = request.form.get('destination') |
| 183 | with open(upload_path, 'wb') as f: |
| 184 | f.write(data) |
| 185 | """ |
| 186 | assert findings_for(code, "OPEN1149"), \ |
| 187 | "OPEN1149 must fire when write path comes from form input" |
| 188 | |
| 189 | # --- True negatives --- |
| 190 | |
| 191 | def test_hardcoded_path_not_flagged(self): |
| 192 | """Hardcoded file path is safe.""" |
| 193 | code = """ |
| 194 | with open('config.toml', 'r') as f: |
| 195 | config = f.read() |
| 196 | """ |
| 197 | assert not findings_for(code, "OPEN1149"), \ |
| 198 | "OPEN1149 must NOT fire for hardcoded file paths" |
| 199 | |
| 200 | def test_local_path_not_flagged(self): |
| 201 | """Path derived from local constants is safe.""" |
| 202 | code = """ |
| 203 | base = '/var/data' |
| 204 | filename = 'output.txt' |
| 205 | path = base + '/' + filename |
| 206 | with open(path) as f: |
| 207 | pass |
| 208 | """ |
| 209 | assert not findings_for(code, "OPEN1149"), \ |
| 210 | "OPEN1149 must NOT fire when path is constructed from local constants" |
| 211 | |
| 212 | |
| 213 | # =========================================================================== |
nothing calls this directly
no outgoing calls
no test coverage detected