File tree Expand file tree Collapse file tree 3 files changed +20
-1
lines changed
test/library-tests/frameworks/stdlib Expand file tree Collapse file tree 3 files changed +20
-1
lines changed Original file line number Diff line number Diff line change
1
+ ---
2
+ category : minorAnalysis
3
+ ---
4
+ * Added header write model for ` send_header ` in ` http.server ` .
Original file line number Diff line number Diff line change @@ -1963,6 +1963,21 @@ module StdlibPrivate {
1963
1963
/** Gets a reference to an instance of the `BaseHttpRequestHandler` class or any subclass. */
1964
1964
DataFlow:: Node instance ( ) { instance ( DataFlow:: TypeTracker:: end ( ) ) .flowsTo ( result ) }
1965
1965
1966
+ /** A call to a method that writes to a response header. */
1967
+ private class HeaderWriteCall extends Http:: Server:: ResponseHeaderWrite:: Range ,
1968
+ DataFlow:: MethodCallNode
1969
+ {
1970
+ HeaderWriteCall ( ) { this .calls ( instance ( ) , "send_header" ) }
1971
+
1972
+ override DataFlow:: Node getNameArg ( ) { result = this .getArg ( 0 ) }
1973
+
1974
+ override DataFlow:: Node getValueArg ( ) { result = this .getArg ( 1 ) }
1975
+
1976
+ override predicate nameAllowsNewline ( ) { any ( ) }
1977
+
1978
+ override predicate valueAllowsNewline ( ) { any ( ) }
1979
+ }
1980
+
1966
1981
private class AdditionalTaintStep extends TaintTracking:: AdditionalTaintStep {
1967
1982
override predicate step ( DataFlow:: Node nodeFrom , DataFlow:: Node nodeTo ) {
1968
1983
nodeFrom = instance ( ) and
Original file line number Diff line number Diff line change @@ -83,7 +83,7 @@ def taint_sources(self):
83
83
def do_GET (self ): # $ requestHandler
84
84
# send_response will log a line to stderr
85
85
self .send_response (200 )
86
- self .send_header ("Content-type" , "text/plain; charset=utf-8" )
86
+ self .send_header ("Content-type" , "text/plain; charset=utf-8" ) # $ headerWriteNameUnsanitized="Content-type" headerWriteValueUnsanitized="text/plain; charset=utf-8"
87
87
self .end_headers ()
88
88
self .wfile .write (b"Hello BaseHTTPRequestHandler\n " )
89
89
self .wfile .writelines ([b"1\n " , b"2\n " , b"3\n " ])
You can’t perform that action at this time.
0 commit comments