Add PR_6_python for python

PR_6_python/python/filtered_java/BenchmarkTest00288.py

@@ -0,0 +1,11 @@
+#{fact rule=os-command-injection@v1.0 defects=0}
+
+import os
+import shlex
+from somewhere import something
+
+
+# ok:dangerous-spawn-process
+os.spawnv(os.P_WAIT, "/bin/ls")
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00298.py

@@ -0,0 +1,21 @@
+#{fact rule=code-injection@v1.0 defects=1}
+
+import flask
+
+app = flask.Flask(__name__)
+
+
+@app.route("/error2")
+def error2(e):
+    # ruleid: dangerous-template-string
+    template = '''{  extends "layout.html"  }
+{  block body  }
+    <div class="center-content error">
+        <h1>Oops! That page doesn't exist.</h1>
+        <h3>%s</h3>
+    </div>
+{  endblock  }
+''' % (request.url)
+    return flask.render_template_string(template), 404
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00389.py

@@ -0,0 +1,12 @@
+#{fact rule=insecure-file-permissions@v1.0 defects=1}
+
+import os
+import stat
+
+def ensure_exec_perms2(file_):
+    st = os.stat(file_)
+    # ruleid:insecure-file-permissions
+    os.chmod(file_, st.st_mode | 0o111)
+    return file_
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00399.py

@@ -0,0 +1,11 @@
+#{fact rule=insecure-cryptography@v1.0 defects=1}
+
+# cf. https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/examples/hashlib_new_insecure_functions.py
+
+import hashlib
+
+# ruleid:insecure-hash-function
+hashlib.new(name='md5', string='test')
+
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00400.py

@@ -0,0 +1,11 @@
+#{fact rule=insecure-connection@v1.0 defects=1}
+
+from urllib.request import OpenerDirector
+
+def test1():
+    od = OpenerDirector()
+    # ruleid: insecure-openerdirector-open-ftp
+    od.open("ftp://example.com")
+
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00410.py

@@ -0,0 +1,9 @@
+#{fact rule=insecure-connection@v1.0 defects=1}
+
+from urllib.request import Request
+
+def test1():
+    # ruleid: insecure-request-object
+    Request("http://example.com")
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00434.py

@@ -0,0 +1,16 @@
+#{fact rule=sql-injection@v1.0 defects=0}
+
+import asyncio
+import asyncpg
+
+
+def ok8(user_input):
+    conn = await aiopg.connect(database='aiopg',
+                               user='aiopg',
+                               password='secret',
+                               host='127.0.0.1')
+    cur = await conn.cursor()
+    # ok: aiopg-sqli
+    cur.execute('SELECT * FROM John'.format())
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00441.py

@@ -0,0 +1,12 @@
+#{fact rule=cross-site-scripting@v1.0 defects=0}
+
+import asyncio
+import asyncpg
+
+
+def ok8(user_input):
+    con = await asyncpg.connect(user='postgres')
+    # ok: asyncpg-sqli
+    con.execute('SELECT * FROM John'.format())
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00451.py

@@ -0,0 +1,12 @@
+#{fact rule=untrusted-deserialization@v1.0 defects=1}
+
+from django.http import HttpResponse
+import datetime
+
+
+
+def current_datetime(request):
+    # ruleid:avoid-insecure-deserialization
+    return "Hey there! {}!".format(pickle.loads(b64decode(request.cookies.get('uuid'))))
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00475.py

@@ -0,0 +1,10 @@
+#{fact rule=code-injection@v1.0 defects=0}
+
+import code
+
+
+def ok4() -> None:
+    inperpreter = code.InteractiveInterpreter()
+    inperpreter.runsource('print(123)')
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00501.py

@@ -0,0 +1,31 @@
+#{fact rule=cross-site-scripting@v1.0 defects=0}
+
+# -*- coding: utf-8 -*-
+import os
+import sqlite3
+
+from flask import Flask
+from flask import redirect
+from flask import request
+from flask import session
+from jinja2 import Template
+
+app = Flask(__name__)
+
+
+@app.route("/loginpage4")
+def render_login_page4():
+    thing = "blah"
+    # the string below is now detected as a literal string after constant
+    # propagation
+    # ok:directly-returned-format-string
+    return thing + '''
+<form method="POST" style="margin: 60px auto; width: 140px;">
+    <p><input name="username" type="text" /></p>
+    <p><input name="password" type="password" /></p>
+    <p><input value="Login" type="submit" /></p>
+</form>
+    '''
+
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00525.py

@@ -0,0 +1,18 @@
+#{fact rule=sql-injection@v1.0 defects=1}
+
+from django.db.models import (
+    CharField, Expression, Field, FloatField, Lookup, TextField, Value,
+)
+from django.db.models.expressions import CombinedExpression, Func, Subquery
+from django.db.models.functions import Cast, Coalesce
+
+
+
+
+
+# ruleid: extends-custom-expression
+class SQCount(Subquery):
+    template = "(SELECT count(*) FROM (%(subquery)s) _count)"
+    output_field = IntegerField()
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00535.py

@@ -0,0 +1,37 @@
+#{fact rule=os-command-injection@v1.0 defects=0}
+
+import requests
+from datetime import timedelta
+from airflow import DAG
+from airflow.operators.bash_operator import BashOperator
+from airflow.utils.dates import days_ago
+
+default_args = {
+    "owner": "airflow",
+    "depends_on_past": False,
+    "start_date": days_ago(2),
+    "email": ["airflow@example.com"],
+    "email_on_failure": False,
+    "email_on_retry": False,
+    "retries": 1,
+    "retry_delay": timedelta(minutes=5)
+}
+
+dag = DAG(
+    "tutorialex2",
+    default_args=default_args,
+    description="Tutorial DAG",
+    schedule_interval=timedelta(days=1)
+)
+
+message = requests.get("https://fakeurl.asdf/message").text
+
+
+# ok: formatted-string-bashoperator
+t5 = BashOperator(
+    task_id="safe",
+    bash_command="echo hello world!",
+    dag=dag
+)
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00540.py

@@ -0,0 +1,11 @@
+#{fact rule=detect-activated-debug-feature@v1.0 defects=1}
+
+import os
+import flask
+app = flask.Flask(__name__)
+
+
+# ruleid: avoid_hardcoded_config_ENV
+app.config["ENV"] = "development"
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00564.py

@@ -0,0 +1,10 @@
+#{fact rule=insecure-connection@v1.0 defects=1}
+
+from urllib.request import OpenerDirector
+
+
+def test3():
+    # ruleid: insecure-openerdirector-open-ftp
+    OpenerDirector().open("ftp://example.com")
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00647.py

@@ -0,0 +1,27 @@
+#{fact rule=cross-site-scripting@v1.0 defects=1}
+
+from django.shortcuts import render
+from django.shortcuts import render_to_response
+from django.utils.html import escape
+
+class FalsePositiveCheck499View(VulnerableTemplateView):
+    title = '(almost) Cross-Site Scripting'
+    tags = ['false-positive', 'GET', 'filtered']
+    description = 'Echo query string parameter to HTML tag attribute removing'\
+                  ' the single quotes which are present in the input.'
+    url_path = '499_check.py?text=1'
+    false_positive_check = True
+    references = ['https://github.com/andresriancho/w3af/pull/499']
+
+    def getB(self, request, *args, **kwds):
+        context = self.get_context_data()
+
+        text = request.GET['text']
+        text = text.replace('"', '')
+
+        # ruleid: raw-html-format
+        context['html'] = '<a href="http://external/abc/' + text + '">Check link href</a>'
+
+        return render(request, self.template_name, context)
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00657.py

@@ -0,0 +1,13 @@
+#{fact rule=cross-site-scripting@v1.0 defects=1}
+
+import urllib
+from django.db.models import Q
+from django.auth import User
+from django.http import HttpResponse, HttpResponseBadRequest
+from django.utils.translation import ugettext as _
+
+def inline_test(request):
+    # ruleid: reflected-data-httpresponsebadrequest
+    return HttpResponseBadRequest("Received {}".format(request.POST.get('message')))
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00690.py

@@ -0,0 +1,19 @@
+# #{ex-fact rule=sql-injection@v1.0 defects=1}
+#
+# from django.http import HttpResponse
+#
+# class Person(models.Model):
+#     first_name = models.CharField(...)
+#     last_name = models.CharField(...)
+#     birth_date = models.DateField(...)
+#
+# ##### raw() True Positives #########
+# def get_user_age(request):
+#   # ruleid: sql-injection-using-raw
+#   user_name = request.get('user_name')
+#   user_age = Person.objects.raw('SELECT user_age FROM myapp_person where user_name = %s' % user_name)
+#   html = "<html><body>User Age %s.</body></html>" % user_age
+#   return HttpResponse(html)
+#
+#
+# #{/ex-fact}

PR_6_python/python/filtered_java/BenchmarkTest00703.py

@@ -0,0 +1,15 @@
+#{fact rule=os-command-injection@v1.0 defects=1}
+
+import os
+import flask
+import hashlib
+
+app = flask.Flask(__name__)
+
+@app.route("/get_param_concat", methods=["GET"])
+def get_param_concat():
+    param = flask.request.args.get("param")
+    # ruleid: os-system-injection
+    os.system("echo " + param)
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00707.py

@@ -0,0 +1,24 @@
+#{fact rule=os-command-injection@v1.0 defects=1}
+
+import os
+import flask
+import hashlib
+
+app = flask.Flask(__name__)
+
+# Real world example
+@app.route('/', methods=['GET', 'POST'])
+def index():
+    if flask.request.method == 'GET':
+        return flask.render_template('index.html')
+    # check url first
+    url = flask.request.form.get('url', None)
+    if url != '':
+        md5 = hashlib.md5(url+app.config['MD5_SALT']).hexdigest()
+        fpath = join(join(app.config['MEDIA_ROOT'], 'upload'), md5+'.jpg')
+        # ruleid: os-system-injection
+        r = os.system('wget %s -O "%s"'%(url, fpath))
+        if r != 0: abort(403)
+        return flask.redirect(flask.url_for('landmark', hash=md5))
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00717.py

@@ -0,0 +1,15 @@
+# #{ex-fact rule=sql-injection@v1.0 defects=1}
+
+# import pg8000.native as pg
+# import pg8000.dbapi
+#
+#
+# import pg8000.native as pg
+# import pg8000.dbapi
+
+# def bad5():
+#     conn = pg8000.connect(user='postgres', password='password', database='andromedabot')
+#     # ruleid: pg8000-sqli
+#     conn.executemany("SELECT name FROM users WHERE age=" + req.FormValue("age"))
+
+# #{/ex-fact}

PR_6_python/python/filtered_java/BenchmarkTest00723.py

@@ -0,0 +1,14 @@
+#{fact rule=sql-injection@v1.0 defects=0}
+
+import pg8000.native as pg
+import pg8000.dbapi
+
+
+def ok3(user_input):
+    conn = pg8000.connect(user='postgres', password='password', database='andromedabot')
+    query = "SELECT name FROM users WHERE age="
+    query += "3"
+    # ok: pg8000-sqli
+    conn.execute(query)
+
+#{/fact}

PR_6_python/python/filtered_java/BenchmarkTest00746.py

@@ -0,0 +1,14 @@
+#{fact rule=cross-site-scripting@v1.0 defects=1}
+
+import os
+import flask
+import hashlib
+
+app = flask.Flask(__name__)
+
+@app.route("/get_param_inline", methods=["GET"])
+def get_param_inline():
+    # ruleid:raw-html-format
+    return "<a href='%s'>Click me!</a>" % flask.request.args.get("param")
+
+#{/fact}