33async def test_taint (request : web .Request ): # $ requestHandler
44
55 ensure_tainted (
6+ # see https://docs.aiohttp.org/en/stable/web_reference.html#request-and-base-request
67 request , # $ tainted
78
89 # yarl.URL (see `yarl` framework tests)
@@ -32,10 +33,7 @@ async def test_taint(request: web.Request): # $ requestHandler
3233 request .headers , # $ tainted
3334 request .headers .getone ("key" ), # $ tainted
3435
35- # https://docs.python.org/3/library/asyncio-protocol.html#asyncio-transport
36- # TODO
37- request .transport , # $ tainted
38- request .transport .get_extra_info ("key" ), # $ MISSING: tainted
36+
3937
4038 # dict-like (readonly)
4139 request .cookies , # $ tainted
@@ -50,9 +48,22 @@ async def test_taint(request: web.Request): # $ requestHandler
5048
5149 # aiohttp.StreamReader
5250 # see https://docs.aiohttp.org/en/stable/streams.html#aiohttp.StreamReader
53- # TODO
5451 request .content , # $ tainted
52+ await request .content .read (), # $ MISSING: tainted
53+ await request .content .readany (), # $ MISSING: tainted
54+ await request .content .readexactly (42 ), # $ MISSING: tainted
55+ await request .content .readline (), # $ MISSING: tainted
56+ await request .content .readchunk (), # $ MISSING: tainted
57+ (await request .content .readchunk ())[0 ], # $ MISSING: tainted
58+ [line async for line in request .content ], # $ MISSING: tainted
59+ [data async for data in request .content .iter_chunked (1024 )], # $ MISSING: tainted
60+ [data async for data in request .content .iter_any ()], # $ MISSING: tainted
61+ [data async for data , _ in request .content .iter_chunks ()], # $ MISSING: tainted
62+ request .content .read_nowait (), # $ MISSING: tainted
63+
64+ # aiohttp.StreamReader
5565 request ._payload , # $ tainted
66+ await request ._payload .readany (), # $ MISSING: tainted
5667
5768 request .content_type , # $ tainted
5869 request .charset , # $ tainted
@@ -66,9 +77,19 @@ async def test_taint(request: web.Request): # $ requestHandler
6677
6778 request .clone (scheme = "https" ), # $ tainted
6879
69- # TODO: like request.transport.get_extra_info
80+ # asyncio.Transport
81+ # https://docs.python.org/3/library/asyncio-protocol.html#asyncio-transport
82+ # example given in https://docs.aiohttp.org/en/stable/web_reference.html#aiohttp.web.BaseRequest.transport
83+ # uses `peername` to get IP address of client
84+ request .transport , # $ tainted
85+ request .transport .get_extra_info ("key" ), # $ MISSING: tainted
86+
87+ # Like request.transport.get_extra_info
7088 request .get_extra_info ("key" ), # $ tainted
7189
90+ # Like request.transport.get_extra_info
91+ request .protocol .transport .get_extra_info ("key" ), # $ MISSING: tainted
92+
7293 # bytes
7394 await request .read (), # $ tainted
7495
0 commit comments