Polish tests

Author: jorgectf

python/ql/test/experimental/query-tests/Security/CWE-611/general.py

@@ -10,49 +10,64 @@
 
 app = Flask(__name__)
 
+# xml_content = '<?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>'
 
-@app.route("/XMLParser-Empty&xml.etree.ElementTree.fromstring")
-def test1():
-    # <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
+
+@app.route("/lxml.etree.fromstring")
+def lxml_fromstring():
     xml_content = request.args['xml_content']
 
-    parser = lxml.etree.XMLParser()
-    # 'root...'
-    return xml.etree.ElementTree.fromstring(xml_content, parser=parser).text
+    return lxml.etree.fromstring(xml_content).text
+
+
+@app.route("/lxml.etree.XML")
+def lxml_XML():
+    xml_content = request.args['xml_content']
+
+    return lxml.etree.XML(xml_content).text
+
+
+@app.route("/lxml.etree.parse")
+def lxml_parse():
+    xml_content = request.args['xml_content']
+
+    return lxml.etree.parse(StringIO(xml_content)).text
 
 
-@app.route("/XMLParser-Empty&xml.etree.ElementTree.parse")
+@app.route("/xmltodict.parse")
+def xmltodict_parse():
+    xml_content = request.args['xml_content']
+
+    return xmltodict.parse(xml_content, disable_entities=False)
+
+
+@app.route("/lxml.etree.XMLParser+lxml.etree.fromstring")
 def test1():
-    # <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
     xml_content = request.args['xml_content']
 
     parser = lxml.etree.XMLParser()
-    # 'jorgectf'
-    return xml.etree.ElementTree.parse(StringIO(xml_content), parser=parser).getroot().text
+    return lxml.etree.fromstring(xml_content, parser=parser).text
 
 
-@app.route("/XMLParser-Empty&lxml.etree.fromstring")
+@app.route("/lxml.etree.get_default_parser+lxml.etree.fromstring")
 def test1():
-    # <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
     xml_content = request.args['xml_content']
 
-    parser = lxml.etree.XMLParser()
-    return lxml.etree.fromstring(xml_content, parser=parser).text  # 'jorgectf'
+    parser = lxml.etree.get_default_parser()
+    return lxml.etree.fromstring(xml_content, parser=parser).text
 
 
-@app.route("/XMLParser-Empty&xml.etree.parse")
+@app.route("/lxml.etree.XMLParser+xml.etree.ElementTree.fromstring")
 def test1():
-    # <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
     xml_content = request.args['xml_content']
 
     parser = lxml.etree.XMLParser()
-    # 'jorgectf'
-    return lxml.etree.parse(StringIO(xml_content), parser=parser).getroot().text
+    return xml.etree.ElementTree.fromstring(xml_content, parser=parser).text
 
 
-@app.route("/xmltodict-disable_entities_False")
-def test2():
-    # <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
+@app.route("/lxml.etree.XMLParser+xml.etree.ElementTree.parse")
+def test1():
     xml_content = request.args['xml_content']
 
-    return xmltodict.parse(xml_content, disable_entities=False)
+    parser = lxml.etree.XMLParser()
+    return xml.etree.ElementTree.parse(StringIO(xml_content), parser=parser).getroot().text

python/ql/test/experimental/query-tests/Security/CWE-611/xml_sax_make_parser.py

@@ -2,11 +2,10 @@
 from io import StringIO
 import xml.sax
 
+# xml_content = '<?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>'
 
 app = Flask(__name__)
 
-# https://docs.python.org/3/library/xml.sax.handler.html#xml.sax.handler.feature_external_ges
-
 
 class MainHandler(xml.sax.ContentHandler):
     def __init__(self):
@@ -24,15 +23,13 @@ def parse(self, f):
 
 @app.route("/MainHandler")
 def test1():
-    # <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
     xml_content = request.args['xml_content']
 
     return MainHandler().parse(StringIO(xml_content))
 
 
 @app.route("/xml.sax.make_parser()+MainHandler")
 def test1():
-    # <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
     xml_content = request.args['xml_content']
 
     BadHandler = MainHandler()
@@ -44,12 +41,12 @@ def test1():
 
 @app.route("/xml.sax.make_parser()+MainHandler-xml.sax.handler.feature_external_ges_False")
 def test1():
-    # <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
     xml_content = request.args['xml_content']
 
     BadHandler = MainHandler()
     parser = xml.sax.make_parser()
     parser.setContentHandler(BadHandler)
+    # https://docs.python.org/3/library/xml.sax.handler.html#xml.sax.handler.feature_external_ges
     parser.setFeature(xml.sax.handler.feature_external_ges, False)
     parser.parse(StringIO(xml_content))
     return BadHandler._result
@@ -59,7 +56,6 @@ def test1():
 
 @app.route("/xml.sax.make_parser()+MainHandler-xml.sax.handler.feature_external_ges_True")
 def test1():
-    # <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
     xml_content = request.args['xml_content']
 
     GoodHandler = MainHandler()
@@ -72,7 +68,6 @@ def test1():
 
 @app.route("/xml.sax.make_parser()+xml.dom.minidom.parse-xml.sax.handler.feature_external_ges_True")
 def test1():
-    # <?xml version="1.0"?><!DOCTYPE dt [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><test>&xxe;</test>
     xml_content = request.args['xml_content']
 
     parser = xml.sax.make_parser()