Flask is a popular Python web microframework. The flask.request global exposes all HTTP input (args, form, json, files, headers, cookies) as taint sources. Response helpers like render_template (SSTI if template is user-controlled) and redirect (open-redirect) are sinks.
.request.args().request.form().request.get_json().request.cookies().request.headers().render_template_string().redirect().send_file().request.args()Sourcerequest.args: MultiDict
URL query string. All values are user-controlled.
return.request.form()Sourcerequest.form: MultiDict
POST form data (application/x-www-form-urlencoded, multipart/form-data).
return.request.get_json()Sourcerequest.get_json(force=False, silent=False, cache=True) -> Any
Parsed JSON request body. User-controlled.
return.request.headers()Sourcerequest.headers: EnvironHeaders
Request headers. User-controlled.
return.render_template_string()Sinkflask.render_template_string(source: str, **context) -> str
Renders a template from a raw string. SSTI sink when source contains user input.
0.redirect()Sinkflask.redirect(location: str, code: int = 302) -> Response
Returns a redirect response. Open-redirect sink when location is user-controlled.
0.send_file()Sinkflask.send_file(path_or_file, ...) -> Response
Serves a file. Path-traversal sink when path is user-controlled.
0| FQN | Field | |
|---|---|---|
| flask | fqns[0] | |
| flask.Request | fqns[1] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyFlask