paulmataruso/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2025-11-04 14:03:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

pysa: Introduce sanitizers, models, and inline marking safe.

Browse Source 
This commit adds three `.pysa` model files: `false_positives.pysa`
for ruling out false positive flows with `Sanitize` annotations,
`req_lib.pysa` for educating pysa about Zulip's `REQ()` pattern for
extracting user input, and `redirects.pysa` for capturing the risk
of open redirects within Zulip code. Additionally, this commit
introduces `mark_sanitized`, an identity function which can be used
to selectively clear taint in cases where `Sanitize` models will not
work. This commit also puts `mark_sanitized` to work removing known
false postive flows.
This commit is contained in:
Graham Bleaney
2019-12-19 18:00:45 -05:00
committed by Tim Abbott
parent 89131bfcbb
commit 461d5b1a3e
15 changed files with 166 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
zerver/lib/url_encoding.py
View File

@@ -1,6 +1,7 @@
import urllib
from typing import Any, Dict, List
from zerver.lib.pysa import mark_sanitized
from zerver.lib.topic import get_topic_from_message_info
from zerver.models import Realm, Stream, UserProfile
@@ -97,8 +98,12 @@ def near_pm_message_url(realm: Realm,
return full_url
def add_query_to_redirect_url(original_url: str, query: str) -> str:
return original_url + "?" + query
# Using 'mark_sanitized' because user-controlled data after the '?' is
# not relevant for open redirects
return original_url + "?" + mark_sanitized(query)
def add_query_arg_to_redirect_url(original_url: str, query_arg: str) -> str:
assert '?' in original_url
return original_url + "&" + query_arg
# Using 'mark_sanitized' because user-controlled data after the '?' is
# not relevant for open redirects
return original_url + "&" + mark_sanitized(query_arg)