diff --git a/src/targets/python/helpers.js b/src/targets/python/helpers.js index a3c5ee7..cdec9ca 100644 --- a/src/targets/python/helpers.js +++ b/src/targets/python/helpers.js @@ -62,7 +62,12 @@ module.exports = { case '[object Object]': { const keyValuePairs = [] for (const k in value) { - keyValuePairs.push(util.format('"%s": %s', k, this.literalRepresentation(value[k], opts, indentLevel))) + keyValuePairs.push( + util.format('%s: %s', + this.literalRepresentation(k, opts, indentLevel), + this.literalRepresentation(value[k], opts, indentLevel) + ) + ) } return concatValues('object', keyValuePairs, opts.pretty && keyValuePairs.length > 1, opts.indent, indentLevel) } diff --git a/test/fixtures/output/python/requests/malicious.py b/test/fixtures/output/python/requests/malicious.py new file mode 100644 index 0000000..0e9a043 --- /dev/null +++ b/test/fixtures/output/python/requests/malicious.py @@ -0,0 +1,47 @@ +import requests + +url = "http://example.test/%27%22%60$(%(%%7B%7B%7B/0%s//" + +querystring = { + "'": "squote-key-test", + "squote-value-test": "'", + "\"": "dquote-key-test", + "dquote-value-test": "\"", + "`": "backtick-key-test", + "backtick-value-test": "`", + "$(": "dollar-parenthesis-key-test", + "dollar-parenthesis-value-test": "$(", + "#{": "hash-brace-key-test", + "hash-brace-value-test": "#{", + "%(": "percent-parenthesis-key-test", + "percent-parenthesis-value-test": "%(", + "%{": "percent-brace-key-test", + "percent-brace-value-test": "%{", + "{{": "double-brace-key-test", + "double-brace-value-test": "{{", + "\\0": "null-key-test", + "null-value-test": "\\0", + "%s": "string-fmt-key-test", + "string-fmt-value-test": "%s", + "\\": "slash-key-test", + "slash-value-test": "\\" +} + +payload = "' \" ` $( #{ %( %{ {{ \\0 %s \\" +headers = { + "squote-value-test": "'", + "dquote-value-test": "\"", + "backtick-value-test": "`", + "dollar-parenthesis-value-test": "$(", + "hash-brace-value-test": "#{", + "percent-parenthesis-value-test": "%(", + "percent-brace-value-test": "%{", + "double-brace-value-test": "{{", + "null-value-test": "\\0", + "string-fmt-value-test": "%s", + "slash-value-test": "\\" +} + +response = requests.post(url, data=payload, headers=headers, params=querystring) + +print(response.text) \ No newline at end of file diff --git a/test/targets.js b/test/targets.js index 501821c..2c0e61a 100644 --- a/test/targets.js +++ b/test/targets.js @@ -44,9 +44,6 @@ const skipMe = { clojure: { clj_http: ['jsonObj-null-value', 'jsonObj-multiline'] }, - python: { - requests: ['malicious'] - }, r: { httr: ['malicious'] },