FastAPI is a modern Python web framework built on Starlette and Pydantic. Path / query / body parameters declared on endpoints are sources. Response helpers inherited from Starlette include HTMLResponse and RedirectResponse (XSS and open-redirect sinks).
.Request.query_params().Request.cookies().Request.headers().Request.json().HTMLResponse().RedirectResponse().Request.query_params()Sourcerequest.query_params: QueryParams
URL query parameters. User-controlled.
return.Request.headers()Sourcerequest.headers: Headers
Request headers. User-controlled.
return.Request.json()Sourceasync Request.json() -> Any
Parsed JSON request body. User-controlled.
return.HTMLResponse()SinkHTMLResponse(content: str, status_code: int = 200, ...) -> Response
Returns raw HTML. XSS sink when content contains unescaped user input.
0.RedirectResponse()SinkRedirectResponse(url: str, status_code: int = 307, ...) -> Response
Returns a redirect. Open-redirect sink when url is user-controlled.
0| FQN | Field | |
|---|---|---|
| fastapi | fqns[0] | |
| fastapi.Request | fqns[1] | |
| starlette.requests.Request | fqns[2] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyFastAPI