import argparse from subprocess import PIPE, run delimiter = '#ยค%&/()=?' results_file = 'tests/results' example_file_path = 'example/vulnerable_code/' python_name = open('tests/python_name.txt', 'r').read().rstrip() encoding = 'utf-8' parser = argparse.ArgumentParser() parser.add_argument('-py', '--python', help='Specify Python 3.', type=str) parser.add_argument('-s', '--save-results', help='Add new results', action='store_true') parser.add_argument('-p', '--pyt-output', help='Print output of PyT for each file.', action='store_true') files = ['XSS.py', 'command_injection.py', 'path_traversal.py', 'path_traversal_sanitised.py', 'sql/sqli.py', 'XSS_form.py', 'XSS_url.py', 'XSS_no_vuln.py', 'XSS_reassign.py', 'XSS_sanitised.py', 'XSS_variable_assign_no_vuln.py', 'XSS_variable_assign.py', 'XSS_variable_multiple_assign.py'] files = [example_file_path + filename for filename in files] def run_pyt(file_input, stdout=PIPE): return run([python_name, '-m', 'pyt', '-f', file_input], stdout=stdout) def check_files(): try: with open(results_file, 'r', encoding=encoding) as fd: results = fd.read().split(delimiter) except FileNotFoundError: print(results_file + ' file was not found.' ' Generate this file by running this' ' script with option --save-results or -s.') exit(1) # last element is empty because # results file always ends with a delimiter: results.pop() passed = True if len(results) != len(files): print('Number of results are not equal to the number of files') print('Results: ' + str(len(results)) + ' Files: ' + str(len(files))) exit(0) for i, f in enumerate(files): print('################# ' + f + ' #################') process = run_pyt(file_input=f) stdout = str(process.stdout) if results[i] == stdout: print('Test passed.') else: print('Test failed.') passed = False return passed def save_results(): with open(results_file, 'w', encoding=encoding) as fd: for f in files: print('################# ' + f + ' #################') process = run_pyt(file_input=f) fd.write(str(process.stdout)) fd.write(delimiter) print('Saved result to file: "' + results_file + '".') def print_pyt_output(): for f in files: print('################# ' + f + ' #################') run_pyt(f, stdout=None) if __name__ == '__main__': args = parser.parse_args() if args.python: print('Set python name in ""python_name.txt".') if args.save_results: save_results() elif args.pyt_output: print_pyt_output() else: check_files()