@@ -63,9 +63,8 @@ def get(self, name = "World!", number="0", foo="foo"): # $ requestHandler route
6363 request .headers ["header-name" ], # $ tainted
6464 request .headers .get_list ("header-name" ), # $ tainted
6565 request .headers .get_all (), # $ tainted
66- [(k , v ) for (k , v ) in request .headers .get_all ()], # $ MISSING: tainted
6766 [(k , v ) for (k , v ) in request .headers .get_all ()][0 ], # $ tainted
68- list ([(k , v ) for (k , v ) in request .headers .get_all ()]), # $ MISSING: tainted
67+ list ([(k , v ) for (k , v ) in request .headers .get_all ()])[ 0 ] , # $ tainted
6968
7069 # Dict[str, http.cookies.Morsel]
7170 request .cookies , # $ tainted
@@ -75,6 +74,11 @@ def get(self, name = "World!", number="0", foo="foo"): # $ requestHandler route
7574 request .cookies ["cookie-name" ].coded_value , # $ tainted
7675 )
7776
77+ ensure_not_tainted (
78+ [(k , v ) for (k , v ) in request .headers .get_all ()], # The comprehension is not tainted, only the elements
79+ list ([(k , v ) for (k , v ) in request .headers .get_all ()]), # Here, all the elements of the list are tainted, but the list is not.
80+ )
81+
7882
7983def make_app ():
8084 return tornado .web .Application (
0 commit comments