Python: Promote cookie injection query from experimental

[joefarebrother]

Part of https://github.com/github/codeql-python-team/issues/792 promoting #6360;
Depends on #16696

Promotes the Cookie Injection query from experimental, finding instances of user input being used to set the name or value of a cookie.

[github-actions]

QHelp previews:

python/ql/src/Security/CWE-020/CookieInjection.qhelp

Construction of a cookie using user-supplied input.

Constructing cookies from user input can allow an attacker to control a user's cookie. This may lead to a session fixation attack. Additionally, client code may not expect a cookie to contain attacker-controlled data, and fail to sanitize it for common vulnerabilities such as Cross Site Scripting (XSS). An attacker manipulating the raw cookie header may additionally be able to set cookie attributes such as HttpOnly to insecure values.

Recommendation

Do not use raw user input to construct cookies.

Example

In the following cases, a cookie is constructed for a Flask response using user input. The first uses set_cookie, and the second sets a cookie's raw value through the set-cookie header.

from flask import request, make_response


@app.route("/1")
def set_cookie():
    resp = make_response()
    resp.set_cookie(request.args["name"], # BAD: User input is used to set the cookie's name and value
                    value=request.args["name"])
    return resp


@app.route("/2")
def set_cookie_header():
    resp = make_response()
    resp.headers['Set-Cookie'] = f"{request.args['name']}={request.args['name']};" # BAD: User input is used to set the raw cookie header.
    return resp

References

• Wikipedia - Session Fixation.
• Common Weakness Enumeration: CWE-20.

[yoff]

Looks like the query is now in the standard format, and the help file is also improved. I suspect we also benefit from more cookie write models.

Two questions:

• Is python/ql/src/experimental/semmle/python/security/injection/CookieInjection.qll still around? Could it be deleted as part of this?
• You have simplified the alert to not mention specific flags. Is that to align with other languages or what is the rationale?

[yoff]

• You have simplified the alert to not mention specific flags. Is that to align with other languages or what is the rationale?

Ah, I guess this has been split out into another query?

[yoff]

LGTM