Repository navigation
Framework adaptor only connects first tainted arg to following nodes #73
Description
In get_func_cfg_with_tainted_args the following taints the args of a framework function, and then links the first arg to the following nodes:
Lines 41 to 52 in a762e00
For a framework function where multiple args are user-controlled, this could miss issues related to second or subsequent args. For example, in Django, URL path elements may be passed to a View as args.
For example /xss1/<param>/ could route to:
def xss1(request, param):
return render(request, 'templates/xss.html', {'param': param})
The suggested fix is to connect each tainted node to the following node in the for loop:
...
func_cfg.nodes.insert(1, tainted_node)
tainted_node.connect(first_node_after_args)
Activity
KevinHock commentedon Dec 12, 2017
Thanks for making this 👍 I'll fix it in my next PR.
davidoc commentedon Dec 12, 2017
Thanks, I have the change locally here. Would it be OK to include this in a PR with a few other changes related to Django support, or better to handle it separately?
KevinHock commentedon Dec 12, 2017
Sure thing, you can put it all in one PR, I'll review it sometime during Dec 23rd-29th. Thanks :D
Connect all arg tainted nodes to following nodes. Fixes python-securi…