Skip to content
This repository was archived by the owner on Mar 15, 2023. It is now read-only.

Commit 4ffa45f

Browse files
jorgectfjorgectf
committed
Add tests
1 parent 16a34e3 commit 4ffa45f

10 files changed

+471
-1
lines changed

‎Code_Injection.py

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
from flask import Flask, request
2+
3+
app = Flask(__name__)
4+
5+
6+
@app.route("/flow1")
7+
def flow1():
8+
code = request.args["code"]
9+
eval(code)
10+
11+
12+
@app.route("/flow2")
13+
def flow2():
14+
email = request.args["email"]
15+
eval("./send_email {email}".format(email=email))
16+
17+
18+
def flow3_extra(text):
19+
return text.split("\n")
20+
21+
@app.route("/flow3")
22+
def flow3():
23+
text = request.args["text"]
24+
eval(flow3_extra(text))
25+
26+
27+
@app.route("/flow4")
28+
def flow4():
29+
text = request.args["text"]
30+
tixt = text
31+
toxt = flow3_extra(tixt)
32+
tuxt = toxt
33+
eval(tuxt)
34+
35+
36+
@app.route("/flow1_good")
37+
def flow1_good():
38+
code = request.args["code"]
39+
if code == "print('Hello, Wo... CodeQL!')":
40+
eval(code)
41+
42+
43+
# if __name__ == "__main__":
44+
# app.run(debug=True)

‎LDAP3_Injection_bad.py

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
from flask import request, Flask
2+
import ldap3
3+
4+
app = Flask(__name__)
5+
6+
7+
@app.route("/normal")
8+
def normal():
9+
"""
10+
A RemoteFlowSource is used directly as DN and search filter
11+
"""
12+
13+
unsafe_dc = request.args['dc']
14+
unsafe_filter = request.args['username']
15+
16+
dn = "dc={}".format(unsafe_dc)
17+
search_filter = "(user={})".format(unsafe_filter)
18+
19+
srv = ldap3.Server('ldap://127.0.0.1')
20+
conn = ldap3.Connection(srv, user=dn, auto_bind=True)
21+
conn.search(dn, search_filter)
22+
23+
24+
@app.route("/direct")
25+
def direct():
26+
"""
27+
A RemoteFlowSource is used directly as DN and search filter using a oneline call to .search
28+
"""
29+
30+
unsafe_dc = request.args['dc']
31+
unsafe_filter = request.args['username']
32+
33+
dn = "dc={}".format(unsafe_dc)
34+
search_filter = "(user={})".format(unsafe_filter)
35+
36+
srv = ldap3.Server('ldap://127.0.0.1')
37+
conn = ldap3.Connection(srv, user=dn, auto_bind=True).search(
38+
dn, search_filter)
39+
40+
# if __name__ == "__main__":
41+
# app.run(debug=True)

‎LDAP3_Injection_good.py

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
from flask import request, Flask
2+
import ldap3
3+
from ldap3.utils.dn import escape_rdn
4+
from ldap3.utils.conv import escape_filter_chars
5+
6+
app = Flask(__name__)
7+
8+
9+
@app.route("/normal")
10+
def normal():
11+
"""
12+
A RemoteFlowSource is sanitized and used as DN and search filter
13+
"""
14+
15+
unsafe_dc = request.args['dc']
16+
unsafe_filter = request.args['username']
17+
18+
safe_dc = escape_rdn(unsafe_dc)
19+
safe_filter = escape_filter_chars(unsafe_filter)
20+
21+
dn = "dc={}".format(safe_dc)
22+
search_filter = "(user={})".format(safe_filter)
23+
24+
srv = ldap3.Server('ldap://127.0.0.1')
25+
conn = ldap3.Connection(srv, user=dn, auto_bind=True)
26+
conn.search(dn, search_filter)
27+
28+
29+
@app.route("/direct")
30+
def direct():
31+
"""
32+
A RemoteFlowSource is sanitized and used as DN and search filter using a oneline call to .search
33+
"""
34+
35+
unsafe_dc = request.args['dc']
36+
unsafe_filter = request.args['username']
37+
38+
safe_dc = escape_rdn(unsafe_dc)
39+
safe_filter = escape_filter_chars(unsafe_filter)
40+
41+
dn = "dc={}".format(safe_dc)
42+
search_filter = "(user={})".format(safe_filter)
43+
44+
srv = ldap3.Server('ldap://127.0.0.1')
45+
conn = ldap3.Connection(srv, user=dn, auto_bind=True).search(
46+
dn, search_filter)
47+
48+
# if __name__ == "__main__":
49+
# app.run(debug=True)

‎LDAP_Injection_bad.py

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
from flask import request, Flask
2+
import ldap
3+
4+
app = Flask(__name__)
5+
6+
7+
@app.route("/normal")
8+
def normal():
9+
"""
10+
A RemoteFlowSource is used directly as DN and search filter
11+
"""
12+
13+
unsafe_dc = request.args['dc']
14+
unsafe_filter = request.args['username']
15+
16+
dn = "dc={}".format(unsafe_dc)
17+
search_filter = "(user={})".format(unsafe_filter)
18+
19+
ldap_connection = ldap.initialize("ldap://127.0.0.1")
20+
user = ldap_connection.search_s(
21+
dn, ldap.SCOPE_SUBTREE, search_filter)
22+
23+
24+
@app.route("/direct")
25+
def direct():
26+
"""
27+
A RemoteFlowSource is used directly as DN and search filter using a oneline call to .search_s
28+
"""
29+
30+
unsafe_dc = request.args['dc']
31+
unsafe_filter = request.args['username']
32+
33+
dn = "dc={}".format(unsafe_dc)
34+
search_filter = "(user={})".format(unsafe_filter)
35+
36+
user = ldap.initialize("ldap://127.0.0.1").search_s(
37+
dn, ldap.SCOPE_SUBTREE, search_filter)
38+
39+
40+
@app.route("/normal_argbyname")
41+
def normal_argbyname():
42+
"""
43+
A RemoteFlowSource is used directly as DN and search filter, while the search filter is specified as
44+
an argument by name
45+
"""
46+
47+
unsafe_dc = request.args['dc']
48+
unsafe_filter = request.args['username']
49+
50+
dn = "dc={}".format(unsafe_dc)
51+
search_filter = "(user={})".format(unsafe_filter)
52+
53+
ldap_connection = ldap.initialize("ldap://127.0.0.1")
54+
user = ldap_connection.search_s(
55+
dn, ldap.SCOPE_SUBTREE, filterstr=search_filter)
56+
57+
58+
# if __name__ == "__main__":
59+
# app.run(debug=True)

‎LDAP_Injection_good.py

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
from flask import request, Flask
2+
import ldap
3+
import ldap.filter
4+
import ldap.dn
5+
6+
app = Flask(__name__)
7+
8+
9+
@app.route("/normal")
10+
def normal():
11+
"""
12+
A RemoteFlowSource is sanitized and used as DN and search filter
13+
"""
14+
15+
unsafe_dc = request.args['dc']
16+
unsafe_filter = request.args['username']
17+
18+
safe_dc = ldap.dn.escape_dn_chars(unsafe_dc)
19+
safe_filter = ldap.filter.escape_filter_chars(unsafe_filter)
20+
21+
dn = "dc={}".format(safe_dc)
22+
search_filter = "(user={})".format(safe_filter)
23+
24+
ldap_connection = ldap.initialize("ldap://127.0.0.1")
25+
user = ldap_connection.search_s(
26+
dn, ldap.SCOPE_SUBTREE, search_filter)
27+
28+
29+
@app.route("/direct")
30+
def direct():
31+
"""
32+
A RemoteFlowSource is sanitized and used as DN and search filter using a oneline call to .search_s
33+
"""
34+
35+
unsafe_dc = request.args['dc']
36+
unsafe_filter = request.args['username']
37+
38+
safe_dc = ldap.dn.escape_dn_chars(unsafe_dc)
39+
safe_filter = ldap.filter.escape_filter_chars(unsafe_filter)
40+
41+
dn = "dc={}".format(safe_dc)
42+
search_filter = "(user={})".format(safe_filter)
43+
44+
user = ldap.initialize("ldap://127.0.0.1").search_s(
45+
dn, ldap.SCOPE_SUBTREE, search_filter, ["testAttr1", "testAttr2"])
46+
47+
48+
@app.route("/normal_argbyname")
49+
def normal_argbyname():
50+
"""
51+
A RemoteFlowSource is sanitized and used as DN and search filter, while the search filter is specified as
52+
an argument by name
53+
"""
54+
55+
unsafe_dc = request.args['dc']
56+
unsafe_filter = request.args['username']
57+
58+
safe_dc = ldap.dn.escape_dn_chars(unsafe_dc)
59+
safe_filter = ldap.filter.escape_filter_chars(unsafe_filter)
60+
61+
dn = "dc={}".format(safe_dc)
62+
search_filter = "(user={})".format(safe_filter)
63+
64+
ldap_connection = ldap.initialize("ldap://127.0.0.1")
65+
user = ldap_connection.search_s(
66+
dn, ldap.SCOPE_SUBTREE, filterstr=search_filter)
67+
68+
69+
# if __name__ == "__main__":
70+
# app.run(debug=True)

‎README.md

+3-1
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
1-
# PracticalCodeQLIntroduction-repo
1+
# PracticalCodeQLIntroduction repo
2+
3+
This repository is meant to be used to run the queries in LGTM shown in [this](https://jorgectf.gitlab.io/blog/post/practical-codeql-introduction/) blog post.

‎Regex_Injection_bad.py

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
from flask import request, Flask
2+
import re
3+
4+
app = Flask(__name__)
5+
6+
7+
@app.route("/direct")
8+
def direct():
9+
"""
10+
A RemoteFlowSource is used directly as re.search's pattern
11+
"""
12+
13+
unsafe_pattern = request.args["pattern"]
14+
re.search(unsafe_pattern, "")
15+
16+
17+
@app.route("/compile")
18+
def compile():
19+
"""
20+
A RemoteFlowSource is used directly as re.compile's pattern
21+
which also executes .search()
22+
"""
23+
24+
unsafe_pattern = request.args["pattern"]
25+
compiled_pattern = re.compile(unsafe_pattern)
26+
compiled_pattern.search("")
27+
28+
29+
@app.route("/compile_direct")
30+
def compile_direct():
31+
"""
32+
A RemoteFlowSource is used directly as re.compile's pattern
33+
which also executes .search() in the same line
34+
"""
35+
36+
unsafe_pattern = request.args["pattern"]
37+
re.compile(unsafe_pattern).search("")
38+
39+
# if __name__ == "__main__":
40+
# app.run(debug=True)

‎Regex_Injection_good.py

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
from flask import request, Flask
2+
import re
3+
4+
5+
@app.route("/direct")
6+
def direct():
7+
unsafe_pattern = request.args['pattern']
8+
safe_pattern = re.escape(unsafe_pattern)
9+
re.search(safe_pattern, "")
10+
11+
12+
@app.route("/compile")
13+
def compile():
14+
unsafe_pattern = request.args['pattern']
15+
safe_pattern = re.escape(unsafe_pattern)
16+
compiled_pattern = re.compile(safe_pattern)
17+
compiled_pattern.search("")

0 commit comments

Comments
 (0)