
    >/i>(                         S SK r S SKrS SKJr  S SKJr   " S S5      rSS jrSS jrS r	S	 r
\R                  " S
5      \R                  " S5      S 5       5       rg)    N)issue)test_propertiesc                   *    \ rS rSrSS jrS rS rSrg)DeepAssignation   Nc                     Xl         X l        g N)var_nameignore_nodes)selfr
   r   s      S/home/james-whalen/.local/lib/python3.13/site-packages/bandit/plugins/django_xss.py__init__DeepAssignation.__init__   s     (    c                     / nU H\  nU R                  U5      nU(       d  M  [        U[        [        45      (       a  UR	                  U5        MK  UR                  U5        M^     U$ r	   )is_assigned
isinstancelisttupleextendappend)r   itemsassignedast_instnew_assigneds        r   is_assigned_inDeepAssignation.is_assigned_in   sV    H++H5L|lT5M::OOL1OOL1  r   c                 F
   SnU R                   (       aF  [        U R                   [        [        [        45      (       a  [        XR                   5      (       a  U$ [        U[
        R                  5      (       a  U R                  UR                  5      nU$ [        U[
        R                  5      (       a  UR                  R                   HL  n[        U[
        R                  5      (       d  M$  UR                  U R                  R                  :X  d  MJ  Us  $    U R                  UR                  5      nU$ [        U[
        R                   5      (       ad  UR"                   HR  n[%        UR&                  SS 5      nXPR                  R                  :X  a  UnM7  U R                  UR                  5      nMT     U$ [        U[
        R(                  5      (       a  / nUR+                  U R                  UR                  5      5        UR+                  U R                  UR,                  5      5        UR+                  U R                  UR.                  5      5        UR+                  U R                  UR0                  5      5        U$ [        U[
        R2                  5      (       a.  / nUR+                  U R                  UR                  5      5        U$ [        U[
        R4                  [
        R6                  [
        R8                  45      (       aX  / nUR+                  U R                  UR                  5      5        UR+                  U R                  UR.                  5      5        U$ [        U[
        R:                  5      (       ae  [        UR<                  [
        R                  5      (       a:  UR<                  R                  U R                  R                  :X  a  UR                  nU$ [        U[
        R>                  5      (       Ga  UR@                  (       Ga  UR@                  S   n[        U[
        R                  5      (       a2  UR                  U R                  R                  :X  a  UR                  nU$ [        U[
        RB                  5      (       a  [        UR                  [
        RB                  5      (       aZ  SnURD                   HH  nUR                  U R                  R                  :X  a  UR                  RD                  U   n  U$ US-  nMJ     U$ )NFidr      )#r   r   r   r   objectastExprr   valueFunctionDefargsNamer   r
   r   bodyWithr   getattroptional_varsTryr   handlersorelse	finalbodyExceptHandlerIfForWhile	AugAssigntargetAssigntargetsTupleelts)r   noder   namewithitemvar_idr5   poss           r   r   DeepAssignation.is_assigned   s   $++dE6-BCCd$5$566#OdCHH%%''

3H\ [ coo..		dCHH--ww$--"2"22'	 '
 **4995HN M chh'' JJ !7!7tD]]---#H#22499=H 'J ? cgg&&HOOD//		:;OOD//>?OOD//<=OOD//?@4 3 c//00HOOD//		:;. - svvsww		:;;HOOD//		:;OOD//<=& % cmm,,$++sxx00;;>>T]]%5%55#zzH  cjj))dlll\\!_F&#((++99 0 00#zzH  FCII..:

CII4 4 "KKDww$--"2"22#'::??3#7 1HC	 (
 r   )r   r
   r	   )__name__
__module____qualname____firstlineno__r   r   r   __static_attributes__ r   r   r   r      s    )	6r   r   c                 v   Sn[        U [        R                  5      (       Ga  [        U[        R                  5      (       a9  UR                  R                   H  nUR
                  U R                  :X  d  M    g   [        X5      nUR                   GH  nUR                  U:  a    U$ UR                  U5      nU(       d  M1  [        U[        R                  5      (       a#  [        UR                  [        5      (       a  SnMs  [        U[        R                  5      (       a  [        XUR                  U5      nM  [        U[        R                  5      (       a  [!        XU5      nM  [        U["        [$        45      (       a  Sn	U H  n
[        U
[        R                  5      (       a&  [        U
R                  [        5      (       a  U	S-  n	MH  [        U
[        R                  5      (       a%  [        XUR                  U5      (       a  U	S-  n	M    O  O   U	['        U5      :X  a  SnGM  Sn  U$ Sn  U$    U$ )NFTr   r    )r   r"   r'   r%   r&   argr   r   r(   linenor   Constantr$   strevaluate_varCallevaluate_callr   r   len)xss_varparentuntilr   securer;   analyserr:   to
num_securesome_tos              r   rK   rK   U   s   F'388$$fcoo..((88wzz)  ) #79KKD{{e#B MA %%d+Brb#,,//Jrxx4M4M!FCHH--)"biiNFCHH--*2|DFT5M22!"J#%%gs||<<#MM3B B '!OJ'::+ 'l    !+a
 %! $& "SW,!%!& M #FMG  F Mr   c                 ^   SnSn[        U [        R                  5      (       a  [        U R                  [        R                  5      (       ab  [        U R                  R
                  [        R                  5      (       a/  U R                  R                  S:X  a  SnU R                  (       a  SnU(       Gav  [        U R                  5      nSnU GHJ  n[        U[        R                  5      (       a&  [        UR
                  [        5      (       a  US-  nMI  [        U[        R                  5      (       a%  [        XqU R                  U5      (       a  US-  nM    O[        U[        R                  5      (       a  [        XqU5      (       a  US-  nM    O[        U[        R                   5      (       af  [        UR
                  [        R"                  [        R$                  45      (       a-  UR'                  UR
                  R(                  5        US-  nGMK    O   U[+        U5      :H  nU$ )NFformatTr   r    )r   r"   rL   func	Attributer$   rI   attrkeywordsr   r&   rJ   r'   rK   rH   rM   StarredListr8   r   r9   rN   )callrP   r   rR   evaluater&   rU   rG   s           r   rM   rM      sx   FH$!!jCMM&J&Jtyy55		(*H}} DII
C#s||,,CIIs1K1Ka
C**T[[,GG!OJC** l;;!OJC--*		CHHcii03 3 CIINN+a
' ( s4y(Mr   c                     [        U [        R                  5      (       Ga^  [        U R                  [        R                  5      n[        U R
                  [        R                  5      =(       a$    [        U R
                  R                  [        5      nU(       a  U(       a  [        R                  " 5       n/ Ul
        / Ul
        S Ul        U R                  Ul        [        R                  " 5       Ul        U R
                  UR                  l        SUR                  l        [        U R                   [        R"                  5      (       a  U R                   R$                  Ul
        U$ U R                   /Ul
        U$ g g g )NrX   )r   r"   BinOpopModleftrI   r$   rJ   rL   r&   r\   rH   rZ   rY   r[   rightr8   r9   )varis_modis_left_strnew_calls       r   transform2callrk      s    #syy!!CFFCGG, 3<<8 
ZHHNNC>
 kxxzHHMHM $H!jjHOMMOHM"%((HMM!)HMM#))SYY// #		 O "%O "6 "r   c                    SnU R                   S   nSn[        U[        R                  5      (       a  U R                  n[        U[        R
                  [        R                  45      (       d=  UR                  n[        U[        R
                  [        R                  45      (       d  M=  Sn[        U[        R                  5      (       a;  UR                   R                    H!  nUR                  UR                  :X  d  M  Sn  O   U(       d  [        X$U R                  5      nGO[        U[        R                  5      (       a  U R                  n[        U[        R
                  [        R                  45      (       d=  UR                  n[        U[        R
                  [        R                  45      (       d  M=  [        X$5      nGO/[        U[        R                  5      (       Ga  [        UR                  [        R                  5      n[        UR                   [        R"                  5      =(       a$    [        UR                   R$                  [&        5      nU(       a  U(       a  U R                  n[        U[        R
                  [        R                  45      (       d=  UR                  n[        U[        R
                  [        R                  45      (       d  M=  [)        U5      n	[        X5      nU(       dK  [*        R,                  " [*        R.                  [*        R0                  [2        R4                  R6                  US9$ g )Nz$Potential XSS on mark_safe function.r   FT)severity
confidencecwetext)r&   r   r"   r'   _bandit_parentModuler%   rG   r   rK   rH   rL   rM   rb   rc   rd   re   rI   r$   rJ   rk   banditIssueMEDIUMHIGHr   Cwe	BASIC_XSS)
r:   descriptionrO   rR   rP   is_paramr;   rh   ri   rj   s
             r   
check_riskr{      s*   8KiilGF'388$$$$Vcjj#//%BCC**F Vcjj#//%BCC fcoo..((88wzz)#H )
 !'4;;?F	GSXX	&	&$$Vcjj#//%BCC**F Vcjj#//%BCCw/	GSYY	'	'GJJ0 s||< 
LLB
 k((F #**coo)FGG.. !#**coo)FGG%g.H"84F||]]{{		##	
 	
 r   rL   B703c                 4   U R                  S5      (       a  / SQnU R                  U;   am  U R                  R                  S   n[	        U[
        R                  5      (       a  [	        UR                  [        5      (       d  [        U R                  5      $ ggg)a  **B703: Potential XSS on mark_safe function**

:Example:

.. code-block:: none

    >> Issue: [B703:django_mark_safe] Potential XSS on mark_safe function.
       Severity: Medium Confidence: High
       CWE: CWE-80 (https://cwe.mitre.org/data/definitions/80.html)
       Location: examples/mark_safe_insecure.py:159:4
       More Info: https://bandit.readthedocs.io/en/latest/plugins/b703_django_mark_safe.html
    158         str_arg = 'could be insecure'
    159     safestring.mark_safe(str_arg)

.. seealso::

 - https://docs.djangoproject.com/en/dev/topics/security/#cross-site-scripting-xss-protection
 - https://docs.djangoproject.com/en/dev/ref/utils/#module-django.utils.safestring
 - https://docs.djangoproject.com/en/dev/ref/utils/#django.utils.html.format_html
 - https://cwe.mitre.org/data/definitions/80.html

.. versionadded:: 1.5.0

.. versionchanged:: 1.7.3
    CWE information added

zdjango.utils.safestring)	mark_safeSafeTextSafeUnicode
SafeString	SafeBytesr   N)
is_module_imported_likecall_function_namer:   r&   r   r"   rI   r$   rJ   r{   )contextaffected_functionsxsss      r   django_mark_safer      s    B &&'@AA
 %%);;,,##A&C3--*SYY2L2L!',,// 3M < Br   r	   )r"   rs   bandit.corer   r   testr   rK   rM   rk   r{   checkstest_idr   rE   r   r   <module>r      se   
    /F FR,^%P,,
^ Vf,0  ,0r   