@@ -0,0 +1 @@
+b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\XSS.py\r\n > User input at line 6, trigger word "get(": \r\n\tparam = request.args.get(\'param\', \'not set\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\XSS.py\r\n\t > Line 6: param = request.args.get(\'param\', \'not set\')\r\n\tFile: ..\\example\\vulnerable_code\\XSS.py\r\n\t > Line 10: ret_make_response = resp\r\nFile: ..\\example\\vulnerable_code\\XSS.py\r\n > reaches line 9, trigger word "replace(": \r\n\tresp = make_response(html.replace(\'{{ param }}\', param))\r\n\r\n'#�%&/()=?b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\command_injection.py\r\n > User input at line 15, trigger word "form[": \r\n\tparam = request.form[\'suggestion\']\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\command_injection.py\r\n\t > Line 15: param = request.form[\'suggestion\']\r\n\tFile: ..\\example\\vulnerable_code\\command_injection.py\r\n\t > Line 16: command = \'echo \' + param + \' >> \' + \'menu.txt\'\r\nFile: ..\\example\\vulnerable_code\\command_injection.py\r\n > reaches line 18, trigger word "subprocess.call(": \r\n\tsubprocess.call(command,shell=True)\r\n\r\n'#�%&/()=?b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\path_traversal.py\r\n > User input at line 8, trigger word "get(": \r\n\timage_name = request.args.get(\'image_name\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\path_traversal.py\r\n\t > Line 8: image_name = request.args.get(\'image_name\')\r\n\tFile: ..\\example\\vulnerable_code\\path_traversal.py\r\n\t > Line 10: ret_request.args.get = 404\r\nFile: ..\\example\\vulnerable_code\\path_traversal.py\r\n > reaches line 11, trigger word "send_file(": \r\n\tret_request.args.get = send_file(os.path.join(os.getcwd(), image_name))\r\n\r\n'#�%&/()=?b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\path_traversal_sanitised.py\r\n > User input at line 8, trigger word "get(": \r\n\timage_name = request.args.get(\'image_name\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\path_traversal_sanitised.py\r\n\t > Line 8: image_name = request.args.get(\'image_name\')\r\n\tFile: ..\\example\\vulnerable_code\\path_traversal_sanitised.py\r\n\t > Line 10: image_name = image_name.replace(\'..\', \'\')\r\nFile: ..\\example\\vulnerable_code\\path_traversal_sanitised.py\r\n > reaches line 12, trigger word "send_file(": \r\n\tret_image_name.replace = send_file(os.path.join(os.getcwd(), image_name))\r\nThis vulnerability is potentially sanitised by: ["\'..\'", "\'..\' in"]\r\n\r\n'#�%&/()=?b'2 vulnerabilities found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\sql\\sqli.py\r\n > User input at line 33, trigger word "get(": \r\n\tparam = request.args.get(\'param\', \'not set\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\sql\\sqli.py\r\n\t > Line 33: param = request.args.get(\'param\', \'not set\')\r\nFile: ..\\example\\vulnerable_code\\sql\\sqli.py\r\n > reaches line 36, trigger word "filter(": \r\n\tresult = session.query(User).filter(\'username={}\'.format(param))\r\n\r\nVulnerability 2:\r\nFile: ..\\example\\vulnerable_code\\sql\\sqli.py\r\n > User input at line 26, trigger word "get(": \r\n\tparam = request.args.get(\'param\', \'not set\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\sql\\sqli.py\r\n\t > Line 26: param = request.args.get(\'param\', \'not set\')\r\nFile: ..\\example\\vulnerable_code\\sql\\sqli.py\r\n > reaches line 27, trigger word "execute(": \r\n\tresult = db.engine.execute(param)\r\n\r\n'#�%&/()=?b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\XSS_form.py\r\n > User input at line 14, trigger word "form[": \r\n\tdata = request.form[\'my_text\']\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\XSS_form.py\r\n\t > Line 14: data = request.form[\'my_text\']\r\n\tFile: ..\\example\\vulnerable_code\\XSS_form.py\r\n\t > Line 17: ret_resp.set_cookie = resp\r\nFile: ..\\example\\vulnerable_code\\XSS_form.py\r\n > reaches line 15, trigger word "replace(": \r\n\tresp = make_response(html1.replace(\'{{ data }}\', data))\r\n\r\n'#�%&/()=?b'0 vulnerabilities found:\r\n'#�%&/()=?b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\XSS_reassign.py\r\n > User input at line 6, trigger word "get(": \r\n\tparam = request.args.get(\'param\', \'not set\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\XSS_reassign.py\r\n\t > Line 6: param = request.args.get(\'param\', \'not set\')\r\n\tFile: ..\\example\\vulnerable_code\\XSS_reassign.py\r\n\t > Line 8: param = param + \'\'\r\n\tFile: ..\\example\\vulnerable_code\\XSS_reassign.py\r\n\t > Line 12: ret_make_response = resp\r\nFile: ..\\example\\vulnerable_code\\XSS_reassign.py\r\n > reaches line 11, trigger word "replace(": \r\n\tresp = make_response(html.replace(\'{{ param }}\', param))\r\n\r\n'#�%&/()=?b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\XSS_sanitised.py\r\n > User input at line 7, trigger word "get(": \r\n\tparam = request.args.get(\'param\', \'not set\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\XSS_sanitised.py\r\n\t > Line 7: param = request.args.get(\'param\', \'not set\')\r\n\tFile: ..\\example\\vulnerable_code\\XSS_sanitised.py\r\n\t > Line 9: param = Markup.escape(param)\r\n\tFile: ..\\example\\vulnerable_code\\XSS_sanitised.py\r\n\t > Line 13: ret_make_response = resp\r\nFile: ..\\example\\vulnerable_code\\XSS_sanitised.py\r\n > reaches line 12, trigger word "replace(": \r\n\tresp = make_response(html.replace(\'{{ param }}\', param))\r\nThis vulnerability is potentially sanitised by: [\'escape\']\r\n\r\n'#�%&/()=?b'0 vulnerabilities found:\r\n'#�%&/()=?b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\XSS_variable_assign.py\r\n > User input at line 6, trigger word "get(": \r\n\tparam = request.args.get(\'param\', \'not set\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\XSS_variable_assign.py\r\n\t > Line 6: param = request.args.get(\'param\', \'not set\')\r\n\tFile: ..\\example\\vulnerable_code\\XSS_variable_assign.py\r\n\t > Line 8: other_var = param + \'\'\r\n\tFile: ..\\example\\vulnerable_code\\XSS_variable_assign.py\r\n\t > Line 12: ret_make_response = resp\r\nFile: ..\\example\\vulnerable_code\\XSS_variable_assign.py\r\n > reaches line 11, trigger word "replace(": \r\n\tresp = make_response(html.replace(\'{{ param }}\', other_var))\r\n\r\n'#�%&/()=?b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\XSS_variable_multiple_assign.py\r\n > User input at line 6, trigger word "get(": \r\n\tparam = request.args.get(\'param\', \'not set\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\XSS_variable_multiple_assign.py\r\n\t > Line 6: param = request.args.get(\'param\', \'not set\')\r\n\tFile: ..\\example\\vulnerable_code\\XSS_variable_multiple_assign.py\r\n\t > Line 8: other_var = param + \'\'\r\n\tFile: ..\\example\\vulnerable_code\\XSS_variable_multiple_assign.py\r\n\t > Line 10: not_the_same_var = \'\' + other_var\r\n\tFile: ..\\example\\vulnerable_code\\XSS_variable_multiple_assign.py\r\n\t > Line 12: another_one = not_the_same_var + \'\'\r\n\tFile: ..\\example\\vulnerable_code\\XSS_variable_multiple_assign.py\r\n\t > Line 17: ret_make_response = resp\r\nFile: ..\\example\\vulnerable_code\\XSS_variable_multiple_assign.py\r\n > reaches line 15, trigger word "replace(": \r\n\tresp = make_response(html.replace(\'{{ param }}\', another_one))\r\n\r\n'#�%&/()=?
@@ -3,14 +3,16 @@
 
 delimiter = '#¤%&/()=?'
 results_file = 'results'
-pyt_path = '../../pyt/pyt.py'
+pyt_path = '../pyt/pyt.py'
+example_file_path = '../example/vulnerable_code/'
 
 parser = argparse.ArgumentParser()
 parser.add_argument('python', help='Specify Python 3.', type=str)
 parser.add_argument('-s', '--save-results', help='Add new results', action='store_true')
 parser.add_argument('-p', '--pyt-output', help='Print output of PyT for each file.', action='store_true')
 
-files = ['XSS.py', 'command_injection.py', 'path_traversal.py', 'path_traversal_sanitised.py', 'path_traversal_sanitised_2.py', 'sql/sqli.py', 'XSS_form.py', 'XSS_no_vuln.py', 'XSS_reassign.py', 'XSS_sanitised.py', 'XSS_variable_assign_no_vuln.py', 'XSS_variable_assign.py', 'XSS_variable_multiple_assign.py']
+files = ['XSS.py', 'command_injection.py', 'path_traversal.py', 'path_traversal_sanitised.py', 'sql/sqli.py', 'XSS_form.py', 'XSS_no_vuln.py', 'XSS_reassign.py', 'XSS_sanitised.py', 'XSS_variable_assign_no_vuln.py', 'XSS_variable_assign.py', 'XSS_variable_multiple_assign.py']
+files = [example_file_path + filename for filename in files]
 
 def check_files(python):
     try:
@@ -19,14 +21,18 @@ def check_files(python):
     except FileNotFoundError:
         print(results_file + ' file was not found. Generate this file by running this script with option --save-results or -s.')
         exit(1)
+
+    passed = True
     for i, f in enumerate(files):
         print('################# ' + f + ' #################')
-        process = run([args.python, pyt_path, f], stdout=PIPE)
+        process = run([python, pyt_path, f], stdout=PIPE)
         stdout = str(process.stdout)
         if results[i] == stdout:
             print('Test passed.')
         else:
             print('Test failed.')
+            passed = False
+    return passed
 
 def save_results(python):
     with open(results_file, 'w') as fd:
 
@@ -2,6 +2,9 @@
 from unittest import TestSuite
 from unittest import makeSuite
 from unittest import TestLoader
+from run import check_files
+
+python = 'python'
 
 test_suite = TestSuite()
 
@@ -11,7 +14,10 @@
 
 runner = TextTestRunner(verbosity=2)
 result = runner.run(suite)
-if result.wasSuccessful():
+
+passed = check_files(python)
+
+if result.wasSuccessful() and passed:
     print('Success')
     exit(0)
 else:
Original file line number	Diff line number	Diff line change
@@ -0,0 +1 @@
	1	+ b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\XSS.py\r\n > User input at line 6, trigger word "get(": \r\n\tparam = request.args.get(\'param\', \'not set\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\XSS.py\r\n\t > Line 6: param = request.args.get(\'param\', \'not set\')\r\n\tFile: ..\\example\\vulnerable_code\\XSS.py\r\n\t > Line 10: ret_make_response = resp\r\nFile: ..\\example\\vulnerable_code\\XSS.py\r\n > reaches line 9, trigger word "replace(": \r\n\tresp = make_response(html.replace(\'{{ param }}\', param))\r\n\r\n'#�%&/()=?b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\command_injection.py\r\n > User input at line 15, trigger word "form[": \r\n\tparam = request.form[\'suggestion\']\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\command_injection.py\r\n\t > Line 15: param = request.form[\'suggestion\']\r\n\tFile: ..\\example\\vulnerable_code\\command_injection.py\r\n\t > Line 16: command = \'echo \' + param + \' >> \' + \'menu.txt\'\r\nFile: ..\\example\\vulnerable_code\\command_injection.py\r\n > reaches line 18, trigger word "subprocess.call(": \r\n\tsubprocess.call(command,shell=True)\r\n\r\n'#�%&/()=?b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\path_traversal.py\r\n > User input at line 8, trigger word "get(": \r\n\timage_name = request.args.get(\'image_name\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\path_traversal.py\r\n\t > Line 8: image_name = request.args.get(\'image_name\')\r\n\tFile: ..\\example\\vulnerable_code\\path_traversal.py\r\n\t > Line 10: ret_request.args.get = 404\r\nFile: ..\\example\\vulnerable_code\\path_traversal.py\r\n > reaches line 11, trigger word "send_file(": \r\n\tret_request.args.get = send_file(os.path.join(os.getcwd(), image_name))\r\n\r\n'#�%&/()=?b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\path_traversal_sanitised.py\r\n > User input at line 8, trigger word "get(": \r\n\timage_name = request.args.get(\'image_name\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\path_traversal_sanitised.py\r\n\t > Line 8: image_name = request.args.get(\'image_name\')\r\n\tFile: ..\\example\\vulnerable_code\\path_traversal_sanitised.py\r\n\t > Line 10: image_name = image_name.replace(\'..\', \'\')\r\nFile: ..\\example\\vulnerable_code\\path_traversal_sanitised.py\r\n > reaches line 12, trigger word "send_file(": \r\n\tret_image_name.replace = send_file(os.path.join(os.getcwd(), image_name))\r\nThis vulnerability is potentially sanitised by: ["\'..\'", "\'..\' in"]\r\n\r\n'#�%&/()=?b'2 vulnerabilities found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\sql\\sqli.py\r\n > User input at line 33, trigger word "get(": \r\n\tparam = request.args.get(\'param\', \'not set\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\sql\\sqli.py\r\n\t > Line 33: param = request.args.get(\'param\', \'not set\')\r\nFile: ..\\example\\vulnerable_code\\sql\\sqli.py\r\n > reaches line 36, trigger word "filter(": \r\n\tresult = session.query(User).filter(\'username={}\'.format(param))\r\n\r\nVulnerability 2:\r\nFile: ..\\example\\vulnerable_code\\sql\\sqli.py\r\n > User input at line 26, trigger word "get(": \r\n\tparam = request.args.get(\'param\', \'not set\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\sql\\sqli.py\r\n\t > Line 26: param = request.args.get(\'param\', \'not set\')\r\nFile: ..\\example\\vulnerable_code\\sql\\sqli.py\r\n > reaches line 27, trigger word "execute(": \r\n\tresult = db.engine.execute(param)\r\n\r\n'#�%&/()=?b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\XSS_form.py\r\n > User input at line 14, trigger word "form[": \r\n\tdata = request.form[\'my_text\']\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\XSS_form.py\r\n\t > Line 14: data = request.form[\'my_text\']\r\n\tFile: ..\\example\\vulnerable_code\\XSS_form.py\r\n\t > Line 17: ret_resp.set_cookie = resp\r\nFile: ..\\example\\vulnerable_code\\XSS_form.py\r\n > reaches line 15, trigger word "replace(": \r\n\tresp = make_response(html1.replace(\'{{ data }}\', data))\r\n\r\n'#�%&/()=?b'0 vulnerabilities found:\r\n'#�%&/()=?b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\XSS_reassign.py\r\n > User input at line 6, trigger word "get(": \r\n\tparam = request.args.get(\'param\', \'not set\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\XSS_reassign.py\r\n\t > Line 6: param = request.args.get(\'param\', \'not set\')\r\n\tFile: ..\\example\\vulnerable_code\\XSS_reassign.py\r\n\t > Line 8: param = param + \'\'\r\n\tFile: ..\\example\\vulnerable_code\\XSS_reassign.py\r\n\t > Line 12: ret_make_response = resp\r\nFile: ..\\example\\vulnerable_code\\XSS_reassign.py\r\n > reaches line 11, trigger word "replace(": \r\n\tresp = make_response(html.replace(\'{{ param }}\', param))\r\n\r\n'#�%&/()=?b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\XSS_sanitised.py\r\n > User input at line 7, trigger word "get(": \r\n\tparam = request.args.get(\'param\', \'not set\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\XSS_sanitised.py\r\n\t > Line 7: param = request.args.get(\'param\', \'not set\')\r\n\tFile: ..\\example\\vulnerable_code\\XSS_sanitised.py\r\n\t > Line 9: param = Markup.escape(param)\r\n\tFile: ..\\example\\vulnerable_code\\XSS_sanitised.py\r\n\t > Line 13: ret_make_response = resp\r\nFile: ..\\example\\vulnerable_code\\XSS_sanitised.py\r\n > reaches line 12, trigger word "replace(": \r\n\tresp = make_response(html.replace(\'{{ param }}\', param))\r\nThis vulnerability is potentially sanitised by: [\'escape\']\r\n\r\n'#�%&/()=?b'0 vulnerabilities found:\r\n'#�%&/()=?b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\XSS_variable_assign.py\r\n > User input at line 6, trigger word "get(": \r\n\tparam = request.args.get(\'param\', \'not set\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\XSS_variable_assign.py\r\n\t > Line 6: param = request.args.get(\'param\', \'not set\')\r\n\tFile: ..\\example\\vulnerable_code\\XSS_variable_assign.py\r\n\t > Line 8: other_var = param + \'\'\r\n\tFile: ..\\example\\vulnerable_code\\XSS_variable_assign.py\r\n\t > Line 12: ret_make_response = resp\r\nFile: ..\\example\\vulnerable_code\\XSS_variable_assign.py\r\n > reaches line 11, trigger word "replace(": \r\n\tresp = make_response(html.replace(\'{{ param }}\', other_var))\r\n\r\n'#�%&/()=?b'1 vulnerability found:\r\nVulnerability 1:\r\nFile: ..\\example\\vulnerable_code\\XSS_variable_multiple_assign.py\r\n > User input at line 6, trigger word "get(": \r\n\tparam = request.args.get(\'param\', \'not set\')\r\nReassigned in: \r\n\tFile: ..\\example\\vulnerable_code\\XSS_variable_multiple_assign.py\r\n\t > Line 6: param = request.args.get(\'param\', \'not set\')\r\n\tFile: ..\\example\\vulnerable_code\\XSS_variable_multiple_assign.py\r\n\t > Line 8: other_var = param + \'\'\r\n\tFile: ..\\example\\vulnerable_code\\XSS_variable_multiple_assign.py\r\n\t > Line 10: not_the_same_var = \'\' + other_var\r\n\tFile: ..\\example\\vulnerable_code\\XSS_variable_multiple_assign.py\r\n\t > Line 12: another_one = not_the_same_var + \'\'\r\n\tFile: ..\\example\\vulnerable_code\\XSS_variable_multiple_assign.py\r\n\t > Line 17: ret_make_response = resp\r\nFile: ..\\example\\vulnerable_code\\XSS_variable_multiple_assign.py\r\n > reaches line 15, trigger word "replace(": \r\n\tresp = make_response(html.replace(\'{{ param }}\', another_one))\r\n\r\n'#�%&/()=?