mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
feat(propose-adjudicate-prove): overlay adjudicates inventory before prove
Regex inventory stays the proposer. MAP attaches promote/demote/unadjudicated/coverage from intra-file taint (tree-sitter when a grammar parses, Python ast as last resort). Deep sandboxes promotions only, ordered by the existing heuristic ranker plus optional OpenRouter mechanism recall. The SAST pair slice scores overlay outcomes; the stage-1 detection gate and local pair gate stay inventory-only.
This commit is contained in:
Marius Ciepluch
@@ -0,0 +1,57 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/sqli-00/BenchmarkTest00011', methods=['GET'])
|
||||
def BenchmarkTest00011_get():
|
||||
response = make_response(render_template('web/sqli-00/BenchmarkTest00011.html'))
|
||||
response.set_cookie('BenchmarkTest00011', 'bar',
|
||||
max_age=60*3,
|
||||
secure=True,
|
||||
path=request.path,
|
||||
domain='localhost')
|
||||
return response
|
||||
return BenchmarkTest00011_post()
|
||||
|
||||
@app.route('/benchmark/sqli-00/BenchmarkTest00011', methods=['POST'])
|
||||
def BenchmarkTest00011_post():
|
||||
RESPONSE = ""
|
||||
|
||||
import urllib.parse
|
||||
param = urllib.parse.unquote_plus(request.cookies.get("BenchmarkTest00011", "noCookieValueSupplied"))
|
||||
|
||||
bar = "This should never happen"
|
||||
if 'should' in bar:
|
||||
bar = param
|
||||
|
||||
import helpers.db_sqlite
|
||||
|
||||
sql = f'SELECT username from USERS where password = ?'
|
||||
con = helpers.db_sqlite.get_connection()
|
||||
cur = con.cursor()
|
||||
cur.execute(sql, (bar,))
|
||||
RESPONSE += (
|
||||
helpers.db_sqlite.results(cur, sql)
|
||||
)
|
||||
con.close()
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,76 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/hash-00/BenchmarkTest00054', methods=['GET'])
|
||||
def BenchmarkTest00054_get():
|
||||
response = make_response(render_template('web/hash-00/BenchmarkTest00054.html'))
|
||||
response.set_cookie('BenchmarkTest00054', 'someSecret',
|
||||
max_age=60*3,
|
||||
secure=True,
|
||||
path=request.path,
|
||||
domain='localhost')
|
||||
return response
|
||||
return BenchmarkTest00054_post()
|
||||
|
||||
@app.route('/benchmark/hash-00/BenchmarkTest00054', methods=['POST'])
|
||||
def BenchmarkTest00054_post():
|
||||
RESPONSE = ""
|
||||
|
||||
import urllib.parse
|
||||
param = urllib.parse.unquote_plus(request.cookies.get("BenchmarkTest00054", "noCookieValueSupplied"))
|
||||
|
||||
string26833 = ''
|
||||
data12 = ''
|
||||
copy = string26833
|
||||
string26833 = ''
|
||||
string26833 += param
|
||||
copy += 'SomeOKString'
|
||||
bar = copy
|
||||
|
||||
import hashlib, base64
|
||||
import io, helpers.utils
|
||||
|
||||
input = ''
|
||||
if isinstance(bar, str):
|
||||
input = bar.encode('utf-8')
|
||||
elif isinstance(bar, io.IOBase):
|
||||
input = bar.read(1000)
|
||||
|
||||
if len(input) == 0:
|
||||
RESPONSE += (
|
||||
'Cannot generate hash: Input was empty.'
|
||||
)
|
||||
return RESPONSE
|
||||
|
||||
hash = hashlib.new('md5')
|
||||
hash.update(input)
|
||||
|
||||
result = hash.digest()
|
||||
f = open(f'{helpers.utils.TESTFILES_DIR}/passwordFile.txt', 'a')
|
||||
f.write(f'hash_value={base64.b64encode(result)}\n')
|
||||
RESPONSE += (
|
||||
f'Sensitive value \'{helpers.utils.escape_for_html(input.decode('utf-8'))}\' hashed and stored.'
|
||||
)
|
||||
f.close()
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,72 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/hash-00/BenchmarkTest00055', methods=['GET'])
|
||||
def BenchmarkTest00055_get():
|
||||
response = make_response(render_template('web/hash-00/BenchmarkTest00055.html'))
|
||||
response.set_cookie('BenchmarkTest00055', 'someSecret',
|
||||
max_age=60*3,
|
||||
secure=True,
|
||||
path=request.path,
|
||||
domain='localhost')
|
||||
return response
|
||||
return BenchmarkTest00055_post()
|
||||
|
||||
@app.route('/benchmark/hash-00/BenchmarkTest00055', methods=['POST'])
|
||||
def BenchmarkTest00055_post():
|
||||
RESPONSE = ""
|
||||
|
||||
import urllib.parse
|
||||
param = urllib.parse.unquote_plus(request.cookies.get("BenchmarkTest00055", "noCookieValueSupplied"))
|
||||
|
||||
num = 106
|
||||
|
||||
bar = "This should never happen" if (7*42) - num > 200 else param
|
||||
|
||||
import hashlib, base64
|
||||
import io, helpers.utils
|
||||
|
||||
input = ''
|
||||
if isinstance(bar, str):
|
||||
input = bar.encode('utf-8')
|
||||
elif isinstance(bar, io.IOBase):
|
||||
input = bar.read(1000)
|
||||
|
||||
if len(input) == 0:
|
||||
RESPONSE += (
|
||||
'Cannot generate hash: Input was empty.'
|
||||
)
|
||||
return RESPONSE
|
||||
|
||||
hash = hashlib.new('sha384')
|
||||
hash.update(input)
|
||||
|
||||
result = hash.digest()
|
||||
f = open(f'{helpers.utils.TESTFILES_DIR}/passwordFile.txt', 'a')
|
||||
f.write(f'hash_value={base64.b64encode(result)}\n')
|
||||
RESPONSE += (
|
||||
f'Sensitive value \'{helpers.utils.escape_for_html(input.decode('utf-8'))}\' hashed and stored.'
|
||||
)
|
||||
f.close()
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,62 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/codeinj-00/BenchmarkTest00073', methods=['GET'])
|
||||
def BenchmarkTest00073_get():
|
||||
response = make_response(render_template('web/codeinj-00/BenchmarkTest00073.html'))
|
||||
response.set_cookie('BenchmarkTest00073', '%27ECHOOO%27',
|
||||
max_age=60*3,
|
||||
secure=True,
|
||||
path=request.path,
|
||||
domain='localhost')
|
||||
return response
|
||||
return BenchmarkTest00073_post()
|
||||
|
||||
@app.route('/benchmark/codeinj-00/BenchmarkTest00073', methods=['POST'])
|
||||
def BenchmarkTest00073_post():
|
||||
RESPONSE = ""
|
||||
|
||||
import urllib.parse
|
||||
param = urllib.parse.unquote_plus(request.cookies.get("BenchmarkTest00073", "noCookieValueSupplied"))
|
||||
|
||||
string41416 = 'help'
|
||||
string41416 += param
|
||||
string41416 += 'snapes on a plane'
|
||||
bar = string41416[4:-17]
|
||||
|
||||
if not bar.startswith('\'') or not bar.endswith('\'') or '\'' in bar[1:-1]:
|
||||
RESPONSE += (
|
||||
"Eval argument must be a plain string literal."
|
||||
)
|
||||
return RESPONSE
|
||||
|
||||
try:
|
||||
RESPONSE += (
|
||||
eval(bar)
|
||||
)
|
||||
except:
|
||||
RESPONSE += (
|
||||
f'Error evaluating expression \'{escape_for_html(bar)}\''
|
||||
)
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,58 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/codeinj-00/BenchmarkTest00074', methods=['GET'])
|
||||
def BenchmarkTest00074_get():
|
||||
response = make_response(render_template('web/codeinj-00/BenchmarkTest00074.html'))
|
||||
response.set_cookie('BenchmarkTest00074', '%27RESPONSE+%2B%3D+%5C%27ECHOOO%5C%27%27',
|
||||
max_age=60*3,
|
||||
secure=True,
|
||||
path=request.path,
|
||||
domain='localhost')
|
||||
return response
|
||||
return BenchmarkTest00074_post()
|
||||
|
||||
@app.route('/benchmark/codeinj-00/BenchmarkTest00074', methods=['POST'])
|
||||
def BenchmarkTest00074_post():
|
||||
RESPONSE = ""
|
||||
|
||||
import urllib.parse
|
||||
param = urllib.parse.unquote_plus(request.cookies.get("BenchmarkTest00074", "noCookieValueSupplied"))
|
||||
|
||||
import configparser
|
||||
|
||||
bar = 'safe!'
|
||||
conf90091 = configparser.ConfigParser()
|
||||
conf90091.add_section('section90091')
|
||||
conf90091.set('section90091', 'keyA-90091', 'a-Value')
|
||||
conf90091.set('section90091', 'keyB-90091', param)
|
||||
bar = conf90091.get('section90091', 'keyB-90091')
|
||||
|
||||
try:
|
||||
exec(bar)
|
||||
except:
|
||||
RESPONSE += (
|
||||
f'Error executing statement \'{escape_for_html(bar)}\''
|
||||
)
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,65 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/deserialization-00/BenchmarkTest00078', methods=['GET'])
|
||||
def BenchmarkTest00078_get():
|
||||
response = make_response(render_template('web/deserialization-00/BenchmarkTest00078.html'))
|
||||
response.set_cookie('BenchmarkTest00078', 'gASVNwAAAAAAAACMCF9fbWFpbl9flIwOc2FmZV90b19waWNrbGWUk5QpgZR9lCiMAWGUjANmb2-UjAFilEtjdWIu',
|
||||
max_age=60*3,
|
||||
secure=True,
|
||||
path=request.path,
|
||||
domain='localhost')
|
||||
return response
|
||||
return BenchmarkTest00078_post()
|
||||
|
||||
@app.route('/benchmark/deserialization-00/BenchmarkTest00078', methods=['POST'])
|
||||
def BenchmarkTest00078_post():
|
||||
RESPONSE = ""
|
||||
|
||||
import urllib.parse
|
||||
param = urllib.parse.unquote_plus(request.cookies.get("BenchmarkTest00078", "noCookieValueSupplied"))
|
||||
|
||||
string9895 = 'help'
|
||||
string9895 += param
|
||||
string9895 += 'snapes on a plane'
|
||||
bar = string9895[4:-17]
|
||||
|
||||
import pickle
|
||||
import base64
|
||||
import helpers.utils
|
||||
|
||||
helpers.utils.sharedstr = "no pickles to be seen here"
|
||||
|
||||
try:
|
||||
unpickled = pickle.loads(base64.urlsafe_b64decode(bar))
|
||||
except:
|
||||
RESPONSE += (
|
||||
'Unpickling failed!'
|
||||
)
|
||||
return RESPONSE
|
||||
|
||||
RESPONSE += (
|
||||
f'shared string is {helpers.utils.sharedstr}'
|
||||
)
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,57 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/deserialization-00/BenchmarkTest00079', methods=['GET'])
|
||||
def BenchmarkTest00079_get():
|
||||
response = make_response(render_template('web/deserialization-00/BenchmarkTest00079.html'))
|
||||
response.set_cookie('BenchmarkTest00079', 'name%3A+safe+data%0Atext%3A+act+like+this+is+conf+data',
|
||||
max_age=60*3,
|
||||
secure=True,
|
||||
path=request.path,
|
||||
domain='localhost')
|
||||
return response
|
||||
return BenchmarkTest00079_post()
|
||||
|
||||
@app.route('/benchmark/deserialization-00/BenchmarkTest00079', methods=['POST'])
|
||||
def BenchmarkTest00079_post():
|
||||
RESPONSE = ""
|
||||
|
||||
import urllib.parse
|
||||
param = urllib.parse.unquote_plus(request.cookies.get("BenchmarkTest00079", "noCookieValueSupplied"))
|
||||
|
||||
bar = param
|
||||
|
||||
import yaml
|
||||
|
||||
try:
|
||||
yobj = yaml.safe_load(bar)
|
||||
|
||||
RESPONSE += (
|
||||
yobj['text']
|
||||
)
|
||||
except:
|
||||
RESPONSE += (
|
||||
"There was an error loading the configuration"
|
||||
)
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,56 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/sqli-00/BenchmarkTest00099', methods=['GET'])
|
||||
def BenchmarkTest00099_get():
|
||||
return BenchmarkTest00099_post()
|
||||
|
||||
@app.route('/benchmark/sqli-00/BenchmarkTest00099', methods=['POST'])
|
||||
def BenchmarkTest00099_post():
|
||||
RESPONSE = ""
|
||||
|
||||
param = request.form.get("BenchmarkTest00099")
|
||||
if not param:
|
||||
param = ""
|
||||
|
||||
import configparser
|
||||
|
||||
bar = 'safe!'
|
||||
conf52528 = configparser.ConfigParser()
|
||||
conf52528.add_section('section52528')
|
||||
conf52528.set('section52528', 'keyA-52528', 'a-Value')
|
||||
conf52528.set('section52528', 'keyB-52528', param)
|
||||
bar = conf52528.get('section52528', 'keyB-52528')
|
||||
|
||||
import helpers.db_sqlite
|
||||
|
||||
sql = f'SELECT username from USERS where password = \'{bar}\''
|
||||
con = helpers.db_sqlite.get_connection()
|
||||
cur = con.cursor()
|
||||
cur.execute(sql)
|
||||
RESPONSE += (
|
||||
helpers.db_sqlite.results(cur, sql)
|
||||
)
|
||||
con.close()
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,63 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/cmdi-00/BenchmarkTest00165', methods=['GET'])
|
||||
def BenchmarkTest00165_get():
|
||||
return BenchmarkTest00165_post()
|
||||
|
||||
@app.route('/benchmark/cmdi-00/BenchmarkTest00165', methods=['POST'])
|
||||
def BenchmarkTest00165_post():
|
||||
RESPONSE = ""
|
||||
|
||||
param = request.form.get("BenchmarkTest00165")
|
||||
if not param:
|
||||
param = ""
|
||||
|
||||
bar = ""
|
||||
if param:
|
||||
lst = []
|
||||
lst.append('safe')
|
||||
lst.append(param)
|
||||
lst.append('moresafe')
|
||||
lst.pop(0)
|
||||
bar = lst[0]
|
||||
|
||||
import os
|
||||
import subprocess
|
||||
import helpers.utils
|
||||
|
||||
argList = []
|
||||
if "Windows" in os.name:
|
||||
argList.append("cmd.exe")
|
||||
argList.append("-c")
|
||||
else:
|
||||
argList.append("sh")
|
||||
argList.append("-c")
|
||||
argList.append(f"echo {bar}")
|
||||
|
||||
proc = subprocess.run(argList, capture_output=True, encoding="utf-8")
|
||||
RESPONSE += (
|
||||
helpers.utils.commandOutput(proc)
|
||||
)
|
||||
|
||||
return RESPONSE
|
||||
|
||||
@@ -0,0 +1,69 @@
|
||||
'''
|
||||
OWASP Benchmark for Python v0.1
|
||||
|
||||
This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.
|
||||
For details, please see https://owasp.org/www-project-benchmark.
|
||||
|
||||
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
|
||||
of the GNU General Public License as published by the Free Software Foundation, version 3.
|
||||
|
||||
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for more details.
|
||||
|
||||
Author: Theo Cartsonis
|
||||
Created: 2025
|
||||
'''
|
||||
|
||||
from flask import redirect, url_for, request, make_response, render_template
|
||||
from helpers.utils import escape_for_html
|
||||
|
||||
def init(app):
|
||||
|
||||
@app.route('/benchmark/cmdi-00/BenchmarkTest00350', methods=['GET'])
|
||||
def BenchmarkTest00350_get():
|
||||
return BenchmarkTest00350_post()
|
||||
|
||||
@app.route('/benchmark/cmdi-00/BenchmarkTest00350', methods=['POST'])
|
||||
def BenchmarkTest00350_post():
|
||||
RESPONSE = ""
|
||||
|
||||
import helpers.separate_request
|
||||
|
||||
wrapped = helpers.separate_request.request_wrapper(request)
|
||||
param = wrapped.get_form_parameter("BenchmarkTest00350")
|
||||
if not param:
|
||||
param = ""
|
||||
|
||||
map11630 = {}
|
||||
map11630['keyA-11630'] = 'a-Value'
|
||||
map11630['keyB-11630'] = param
|
||||
map11630['keyC'] = 'another-Value'
|
||||
bar = "safe!"
|
||||
bar = map11630['keyB-11630']
|
||||
bar = map11630['keyA-11630']
|
||||
|
||||
import platform
|
||||
import subprocess
|
||||
import helpers.utils
|
||||
|
||||
argStr = ""
|
||||
if platform.system() == "Windows":
|
||||
argStr = "cmd.exe /c "
|
||||
else:
|
||||
argStr = "sh -c "
|
||||
argStr += f"echo {bar}"
|
||||
|
||||
try:
|
||||
proc = subprocess.run(argStr, shell=True, capture_output=True, encoding="utf-8")
|
||||
|
||||
RESPONSE += (
|
||||
helpers.utils.commandOutput(proc)
|
||||
)
|
||||
except IOError:
|
||||
RESPONSE += (
|
||||
"Problem executing cmdi - subprocess.run(list) Test Case"
|
||||
)
|
||||
|
||||
return RESPONSE
|
||||
|
||||
Reference in New Issue
Block a user