Skip to content

Commit 2cffb21

Browse files
joefarebrotherjoefarebrother
committed
Update and fix tests
1 parent d28e800 commit 2cffb21

File tree

8 files changed

+30
-39
lines changed

8 files changed

+30
-39
lines changed

‎python/ql/lib/semmle/python/Concepts.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1296,7 +1296,7 @@ module Http {
12961296
exists(DataFlow::Node name |
12971297
name = [this.getNameArg(), this.getHeaderArg()] and
12981298
(
1299-
name instanceof SensitiveDataSource
1299+
DataFlow::localFlow(any(SensitiveDataSource src), name)
13001300
or
13011301
name = sensitiveLookupStringConst(_)
13021302
)

‎python/ql/src/Security/CWE-1004/NonHttpOnlyCookie.ql‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,7 @@ import semmle.python.dataflow.new.DataFlow
1515
import semmle.python.Concepts
1616

1717
from Http::Server::CookieWrite cookie
18-
where cookie.hasHttpOnlyFlag(false)
18+
where
19+
cookie.hasHttpOnlyFlag(false) and
20+
cookie.isSensitive()
1921
select cookie, "Cookie is added without the HttpOnly attribute properly set."

‎python/ql/src/Security/CWE-1275/SameSiteNoneCookie.ql‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* @description Cookies with `SameSite` set to `None` can allow for Cross-Site Request Forgery (CSRF) attacks.
44
* @kind problem
55
* @problem.severity warning
6-
* @security-severity 3.5
6+
* @security-severity 4.0
77
* @precision high
88
* @id py/samesite-none-cookie
99
* @tags security
@@ -15,5 +15,7 @@ import semmle.python.dataflow.new.DataFlow
1515
import semmle.python.Concepts
1616

1717
from Http::Server::CookieWrite cookie
18-
where cookie.hasSameSiteAttribute(any(Http::Server::CookieWrite::SameSiteNone v))
18+
where
19+
cookie.hasSameSiteAttribute(any(Http::Server::CookieWrite::SameSiteNone v)) and
20+
cookie.isSensitive()
1921
select cookie, "Cookie is added with the SameSite attribute set to None."

‎python/ql/src/Security/CWE-614/InsecureCookie.ql‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import semmle.python.dataflow.new.DataFlow
1616
import semmle.python.Concepts
1717

1818
from Http::Server::CookieWrite cookie
19-
where cookie.hasSecureFlag(false) //and
20-
//cookie.isSensitive()
19+
where
20+
cookie.hasSecureFlag(false) and
21+
cookie.isSensitive()
2122
select cookie, "Cookie is added without the Secure attribute properly set."

‎python/ql/test/query-tests/Security/CWE-1004-NonHttpOnlyCookie/NonHttpOnlyCookie.expected‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
| test.py:8:5:8:37 | ControlFlowNode for Attribute() | Cookie is added without the HttpOnly attribute properly set. |
2-
| test.py:9:5:9:50 | ControlFlowNode for Attribute() | Cookie is added without the HttpOnly attribute properly set. |
3-
| test.py:11:5:11:56 | ControlFlowNode for Attribute() | Cookie is added without the HttpOnly attribute properly set. |
4-
| test.py:12:5:12:53 | ControlFlowNode for Attribute() | Cookie is added without the HttpOnly attribute properly set. |
5-
| test.py:13:5:13:54 | ControlFlowNode for Attribute() | Cookie is added without the HttpOnly attribute properly set. |
6-
| test.py:14:5:14:69 | ControlFlowNode for Attribute() | Cookie is added without the HttpOnly attribute properly set. |
7-
| test.py:16:5:16:67 | ControlFlowNode for Attribute() | Cookie is added without the HttpOnly attribute properly set. |
1+
| test.py:8:5:8:38 | ControlFlowNode for Attribute() | Cookie is added without the HttpOnly attribute properly set. |
2+
| test.py:9:5:9:51 | ControlFlowNode for Attribute() | Cookie is added without the HttpOnly attribute properly set. |
3+
| test.py:11:5:11:57 | ControlFlowNode for Attribute() | Cookie is added without the HttpOnly attribute properly set. |

‎python/ql/test/query-tests/Security/CWE-1004-NonHttpOnlyCookie/test.py‎

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,8 @@
55
@app.route("/test")
66
def test():
77
resp = make_response()
8-
resp.set_cookie("key1", "value1") # $Alert[py/client-exposed-cookie]
9-
resp.set_cookie("key2", "value2", secure=True) # $Alert[py/client-exposed-cookie]
10-
resp.set_cookie("key2", "value2", httponly=True)
11-
resp.set_cookie("key2", "value2", samesite="Strict") # $Alert[py/client-exposed-cookie]
12-
resp.set_cookie("key2", "value2", samesite="Lax") # $Alert[py/client-exposed-cookie]
13-
resp.set_cookie("key2", "value2", samesite="None") # $Alert[py/client-exposed-cookie]
14-
resp.set_cookie("key2", "value2", secure=True, samesite="Strict") # $Alert[py/client-exposed-cookie]
15-
resp.set_cookie("key2", "value2", httponly=True, samesite="Strict")
16-
resp.set_cookie("key2", "value2", secure=True, samesite="None") # $Alert[py/client-exposed-cookie]
17-
resp.set_cookie("key2", "value2", httponly=True, samesite="None")
18-
resp.set_cookie("key2", "value2", secure=True, httponly=True, samesite="Strict")
8+
resp.set_cookie("oauth", "value1") # $Alert[py/client-exposed-cookie]
9+
resp.set_cookie("oauth", "value2", secure=True) # $Alert[py/client-exposed-cookie]
10+
resp.set_cookie("oauth", "value2", httponly=True)
11+
resp.set_cookie("oauth", "value2", samesite="Strict") # $Alert[py/client-exposed-cookie]
12+
resp.set_cookie("oauth", "value2", httponly=True, samesite="None")

‎python/ql/test/query-tests/Security/CWE-1275-SameSiteNoneCookie/SameSiteNoneCookie.expected‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,2 @@
1-
| test.py:13:5:13:54 | ControlFlowNode for Attribute() | Cookie is added with the SameSite attribute set to None. |
2-
| test.py:16:5:16:67 | ControlFlowNode for Attribute() | Cookie is added with the SameSite attribute set to None. |
3-
| test.py:17:5:17:69 | ControlFlowNode for Attribute() | Cookie is added with the SameSite attribute set to None. |
1+
| test.py:10:5:10:60 | ControlFlowNode for Attribute() | Cookie is added with the SameSite attribute set to None. |
2+
| test.py:13:5:13:78 | ControlFlowNode for Attribute() | Cookie is added with the SameSite attribute set to None. |

‎python/ql/test/query-tests/Security/CWE-1275-SameSiteNoneCookie/test.py‎

Lines changed: 9 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,13 @@
33
app = Flask(__name__)
44

55
@app.route("/test")
6-
def test():
6+
def test(oauth_cookie_name):
77
resp = make_response()
8-
resp.set_cookie("key1", "value1")
9-
resp.set_cookie("key2", "value2", secure=True)
10-
resp.set_cookie("key2", "value2", httponly=True)
11-
resp.set_cookie("key2", "value2", samesite="Strict")
12-
resp.set_cookie("key2", "value2", samesite="Lax")
13-
resp.set_cookie("key2", "value2", samesite="None") # $Alert[py/samesite-none-cookie]
14-
resp.set_cookie("key2", "value2", secure=True, samesite="Strict")
15-
resp.set_cookie("key2", "value2", httponly=True, samesite="Strict")
16-
resp.set_cookie("key2", "value2", secure=True, samesite="None") # $Alert[py/samesite-none-cookie]
17-
resp.set_cookie("key2", "value2", httponly=True, samesite="None") # $Alert[py/samesite-none-cookie]
18-
resp.set_cookie("key2", "value2", secure=True, httponly=True, samesite="Strict")
8+
resp.set_cookie("password", "value1")
9+
resp.set_cookie("authKey", "value2", samesite="Lax")
10+
resp.set_cookie("session_id", "value2", samesite="None") # $Alert[py/samesite-none-cookie]
11+
resp.set_cookie("oauth", "value2", secure=True, samesite="Strict")
12+
resp.set_cookie("oauth", "value2", httponly=True, samesite="Strict")
13+
resp.set_cookie(oauth_cookie_name, "value2", secure=True, samesite="None") # $Alert[py/samesite-none-cookie]
14+
resp.set_cookie("not_sensitive", "value2", samesite="None")
15+

0 commit comments

Comments
 (0)