requests is the most popular HTTP client for Python. All top-level methods and Session methods accept a URL as the first argument — SSRF sink when the URL is user-controlled. verify=False disables TLS verification (separate rule).
.get().post().put().delete().request().get()Sinkrequests.get(url: str, params=None, **kwargs) -> Response
Sends a GET request. SSRF sink when url is user-controlled.
0.post()Sinkrequests.post(url: str, data=None, json=None, **kwargs) -> Response
Sends a POST request. SSRF sink when url is user-controlled.
0.put()Sinkrequests.put(url: str, data=None, **kwargs) -> Response
Sends a PUT request. SSRF sink.
0.delete()Sinkrequests.delete(url: str, **kwargs) -> Response
Sends a DELETE request. SSRF sink.
0.request()Sinkrequests.request(method: str, url: str, **kwargs) -> Response
Sends a request with arbitrary method. SSRF sink on url.
1| FQN | Field | |
|---|---|---|
| requests | fqns[0] | |
| requests.Session | fqns[1] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyRequests