[WIP] Fix false-negatives and false-positives

example/november_2017_evaluation/false_negatives/encode_tainted.py

@@ -0,0 +1,5 @@
+@app.route('/encode_tainted')
+def encode_tainted():
+    state = request.args.get('state', '')
+    next = base64.urlsafe_b64decode(state.encode('ascii'))
+    return redirect(next)

example/november_2017_evaluation/false_negatives/if_else_in_sink.py

@@ -0,0 +1,52 @@
+"""
+This is very similar to one of the false-negatives found in our November 16th/17th 2017 evaluation
+http://pyt.readthedocs.io/en/latest/past_evaluations.html#november-16-17th-2017
+"""
+import scrypt
+
+
+@app.route('/login', methods=['GET', 'POST'])
+def login():
+	# 2 bool op
+    # print('foo')
+    # x = 5
+    # laun = request.args.get('Laundry')
+    laun = 'beep'
+    # return redirect(request.args.get('The') or request.args.get('French') or 'laun' and 'crazy')
+    # return redirect(request.args.get('The') or request.args.get('French') or request.args.get('Laundry') and 'crazy')
+
+    # works
+    # return redirect(request.args.get('The') or request.args.get('French') or 'crazy' and request.args.get('Laundry'))
+
+    # return redirect(request.args.get('The') if 1==2 else request.args.get('French') if 'foo' else 'crazy')
+    # return redirect(request.args.get('The') if 1==2 else request.args.get('French') if 'foo' else request.args.get('Aces'))
+
+    # return redirect(request.args.get('The') if 'hey' or 'you' else request.args.get('French') if 'foo' else 'c' and request.args.get('Aces'))
+    return redirect(request.args.get('The') if 'hey' or 'you' else request.args.get('French') if 'foo' else request.args.get('Aces') and 'c')
+
+
+    # works
+    # return redirect('crazy' and request.args.get('Laundry') )
+
+
+    # return redirect(request.args.get('The') if 1==2 else request.args.get('French'))
+    # return redirect(request.args.get('The') if 1==2 else laun)
+
+    # return redirect(request.args.get('The'))
+
+
+    # return redirect(request.args.get('The') if 1==2 else 'foo')
+    # return redirect('beep', request.args.get('The'))
+    # return redirect(request.args.get('The') if 1==2 else 'beep')
+    # return redirect(request.args.get('The'))
+    # return 'The'
+    # return redirect('The')
+
+
+    # 2 IfExp and a string
+    # return redirect(request.args.get('The') if 1==2 else request.args.get('French') if 2==3 else 'Laundry')
+    # 3 IfExp
+    # return redirect(request.args.get('The') if 1==2 else request.args.get('French') if 2==3 else request.args.get('Laundry'))
+
+    # All 3
+    # return redirect(request.args.get('The') if 5==5 else url_for('French'), request.args.get('Laundry') or url_for('Sushiritto'), scrypt.encrypt('Mixt'))

example/november_2017_evaluation/false_negatives/index_of_tainted.py

@@ -0,0 +1,5 @@
+@app.route('/index_of_tainted')
+def index_of_tainted():
+    state = request.args.get('state', '')
+    next = base64.urlsafe_b64decode(state).split(';')[1]
+    return redirect(next)

example/november_2017_evaluation/false_negatives/oakie_auth.py

@@ -0,0 +1,20 @@
+"""
+One of the false-negatives found in our November 16th/17th 2017 evaluation
+http://pyt.readthedocs.io/en/latest/past_evaluations.html#november-16-17th-2017
+"""
+
+@app.route('/auth_callback')
+def auth_callback():
+    error = request.args.get('error', '')
+    if error:
+        return 'Error: ' + error
+    state = request.args.get('state', '')
+    if not is_valid_state(state):
+        abort(403)
+    next = base64.urlsafe_b64decode(state.encode('ascii')).split(';')[1]
+    remove_state(state)
+    code = request.args.get('code')
+    id_token, access_token = get_tokens(code)
+
+    session['email'] = id_token['email']
+    return redirect(next)

example/november_2017_evaluation/false_negatives/or_in_sink.py

@@ -0,0 +1,8 @@
+"""
+This is very similar to one of the false-negatives found in our November 16th/17th 2017 evaluation
+http://pyt.readthedocs.io/en/latest/past_evaluations.html#november-16-17th-2017
+"""
+
+@app.route('/login', methods=['GET', 'POST'])
+def login():
+    return redirect(request.args.get("next") or url_for("index"))

example/november_2017_evaluation/false_negatives/source_nested_in_sink.py

@@ -0,0 +1,9 @@
+"""
+This is very similar to one of the false-negatives found in our November 16th/17th 2017 evaluation
+http://pyt.readthedocs.io/en/latest/past_evaluations.html#november-16-17th-2017
+"""
+
+
+@app.route('/login', methods=['GET', 'POST'])
+def login():
+    return redirect(request.args.get("next"))

example/november_2017_evaluation/false_negatives/split_tainted.py

@@ -0,0 +1,5 @@
+@app.route('/split_tainted')
+def split_tainted():
+    state = request.args.get('state', '')
+    next = base64.urlsafe_b64decode(state).split(';')
+    return redirect(next)

example/november_2017_evaluation/false_positives/cheapskate_get_image.py

@@ -0,0 +1,13 @@
+@app.route('/image', methods = ['GET'])
+def get_image():
+  url = request.args.get('url', '')
+  if not url:
+    abort(400)
+
+  if is_image(url):
+    return redirect(url)
+
+def is_image(url):
+  image_extensions = ['.jpg', '.gif', '.png', '.jpg', '.bmp', '.webp', '.webm']
+  extension = url[url.rfind('.'):]
+  return extension in image_extensions

example/november_2017_evaluation/false_positives/first_or_second_arg_of_sink.py

@@ -0,0 +1,11 @@
+"""A minimized version of flask_expand_url to illustrate the question of 'what args being tainted means a vulnerability?'"""
+
+from Flask import g
+
+@app.route('/<david>')
+def expand_url(david):
+    foster = query_db('select url_long from urls where david = ?', [david])
+
+
+def query_db(query, args=()):
+    wallace = g.db.execute(query, args)

example/november_2017_evaluation/false_positives/flaskly_expand_url.py

@@ -0,0 +1,20 @@
+from Flask import g
+
+@app.route('/<url_short>')
+def expand_url(url_short):
+    """Check for url in DB"""
+    result = query_db('select url_long from urls where url_short = ?',
+                        [url_short], one=True)
+    if result is None:
+        return redirect(url_for("index"))
+    else:
+        link = result['url_long']
+        return redirect(link)
+
+
+def query_db(query, args=(), one=False):
+    """Queries the database and returns a list of dictionaries."""
+    cur = g.db.execute(query, args)
+    rv = [dict((cur.description[idx][0], value)
+               for idx, value in enumerate(row)) for row in cur.fetchall()]
+    return (rv[0] if rv else None) if one else rv

example/november_2017_evaluation/false_positives/front_or_end_of_string.py

@@ -0,0 +1,9 @@
+"""
+One of the false-positives found in our November 16th/17th 2017 evaluation
+http://pyt.readthedocs.io/en/latest/past_evaluations.html#november-16-17th-2017
+"""
+@app.route('/client/passport', methods=['POST','GET'])
+def client_passport():
+    code = request.args.get('code')
+    uri = 'http://localhost:5000/oauth?response_type=%s&client_id=%s&redirect_uri=%s' %(code,client_id,redirect_uri)
+    return redirect(uri)

examples/vulnerable_code_with_expressions/connecting_control_flow_exprs_in_connect_expressions.py

@@ -0,0 +1,12 @@
+"""
+This is very similar to one of the false-negatives found in our November 16th/17th 2017 evaluation
+http://pyt.readthedocs.io/en/latest/past_evaluations.html#november-16-17th-2017
+"""
+
+redirect(
+	request.args.get('Laundry') and 'crazy'
+	or
+	request.args.get('French') and 'foo'
+	or
+	request.args.get('The')
+)

examples/vulnerable_code_with_expressions/last_var_in_and_is_not_tainted.py

@@ -0,0 +1,6 @@
+"""
+This is very similar to one of the false-negatives found in our November 16th/17th 2017 evaluation
+http://pyt.readthedocs.io/en/latest/past_evaluations.html#november-16-17th-2017
+"""
+
+redirect(request.args.get('The') if 'hey' or 'you' else request.args.get('French') if 'foo' else request.args.get('Aces') and 'c')

examples/vulnerable_code_with_expressions/last_var_in_and_is_tainted.py

@@ -0,0 +1,6 @@
+"""
+This is very similar to one of the false-negatives found in our November 16th/17th 2017 evaluation
+http://pyt.readthedocs.io/en/latest/past_evaluations.html#november-16-17th-2017
+"""
+
+redirect(request.args.get('The') if 'hey' or 'you' else request.args.get('French') if 'foo' else 'c' and request.args.get('Aces'))

pyt/cfg/README.rst

@@ -28,7 +28,7 @@ So as you'll see, there is a `visit\_` function for almost every AST node type.
 The two most illustrative functions are `stmt_star_handler`_ and expr_star_handler. expr_star_handler has not been merged to master so let's talk about `stmt_star_handler`_.
 
 
-Handling an if: statement 
+Handling an if: statement
 =========================
 
 Example code
@@ -43,7 +43,7 @@ This is the relevant part of the `abstract grammar`_
 .. code-block:: python
 
   If(expr test, stmt* body, stmt* orelse)
-  # Note: stmt* means any number of statements. 
+  # Note: stmt* means any number of statements.
 
 
 Upon visiting an if: statement we will enter `visit_If`_ in `stmt_visitor.py`_. Since we know that the test is just one expression, we can just call self.visit() on it. The body could be an infinite number of statements, so we use the `stmt_star_handler`_ function.