Python: detecting header splitting in synthetic app

[yoff]

Follow up work for https://github.com/github/field-security-codeql/issues/194

[Copilot]

Pull request overview

This PR adds test coverage and modeling for header injection vulnerabilities using Python's http.server module and extends support for urllib.parse.ParseResult.

Key changes:

• Adds a test case demonstrating header injection vulnerability in http.server.BaseHTTPRequestHandler
• Introduces models for urllib.parse.ParseResult class to track taint propagation through URL parsing
• Extends urllib.parse.urlparse function modeling with taint propagation

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
python/ql/test/query-tests/Security/CWE-113-HeaderInjection/Tests1/http_test.py	New test case demonstrating header injection vulnerability using http.server module
python/ql/test/query-tests/Security/CWE-113-HeaderInjection/Tests1/HeaderInjection.expected	Updated expected test results to include new test case findings (generated file)
python/ql/lib/semmle/python/frameworks/Stdlib.qll	Adds ParseResult module with taint tracking for urllib.parse.ParseResult class
python/ql/lib/semmle/python/frameworks/Stdlib.model.yml	Adds taint model for urlparse function and type model for ParseResult class

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This comment appears to contain commented-out code.

Suggested change

	# if __name__ == "__main__":
	# print("Serving vulnerable app on http://127.0.0.1:8080")
	# httpd = HTTPServer(("127.0.0.1", 8080), VulnerableHandler)
	# httpd.serve_forever()
	# To run this server manually for testing, use:
	# python -m http.server 8080 --bind 127.0.0.1
	# Or implement the main block as shown in documentation.

[yoff]

We normally leave such a code block there, so people can easily test for actual vulnerabilities.

[Copilot]

Import of 'HTTPServer' is not used.

Suggested change

	from http.server import HTTPServer, BaseHTTPRequestHandler
	from http.server import BaseHTTPRequestHandler

[joefarebrother]

Looks good 👍

[yoff]

Performance looks fine, merging.