@@ -63,9 +63,8 @@ def get(self, name = "World!", number="0", foo="foo"): # $ requestHandler route
63
63
request .headers ["header-name" ], # $ tainted
64
64
request .headers .get_list ("header-name" ), # $ tainted
65
65
request .headers .get_all (), # $ tainted
66
- [(k , v ) for (k , v ) in request .headers .get_all ()], # $ MISSING: tainted
67
66
[(k , v ) for (k , v ) in request .headers .get_all ()][0 ], # $ tainted
68
- list ([(k , v ) for (k , v ) in request .headers .get_all ()]), # $ MISSING: tainted
67
+ list ([(k , v ) for (k , v ) in request .headers .get_all ()])[ 0 ] , # $ tainted
69
68
70
69
# Dict[str, http.cookies.Morsel]
71
70
request .cookies , # $ tainted
@@ -75,6 +74,11 @@ def get(self, name = "World!", number="0", foo="foo"): # $ requestHandler route
75
74
request .cookies ["cookie-name" ].coded_value , # $ tainted
76
75
)
77
76
77
+ ensure_not_tainted (
78
+ [(k , v ) for (k , v ) in request .headers .get_all ()], # The comprehension is not tainted, only the elements
79
+ list ([(k , v ) for (k , v ) in request .headers .get_all ()]), # Here, all the elements of the list are tainted, but the list is not.
80
+ )
81
+
78
82
79
83
def make_app ():
80
84
return tornado .web .Application (
0 commit comments