Este producto no es compatible con el sitio Datadog seleccionado. ().
Esta página aún no está disponible en español. Estamos trabajando en su traducción.
Si tienes alguna pregunta o comentario sobre nuestro actual proyecto de traducción, no dudes en ponerte en contacto con nosotros.

Metadata

ID: python-flask/open-file-unsanitized-data

Language: Python

Severity: Error

Category: Security

CWE: 22

Description

Use of unsanitized from incoming request, leading to potential data leak and lack of control of the service. Do not use unsanitized data to control file operations. The code should check any incoming data and make sure it’s safe to use it.

Learn More

Non-Compliant Code Examples

@app.route("/read")
def read_file():
    filename = request.args.get("filename")
    if not filename:
        return "Missing 'filename' parameter", 400
    try:
        with open(filename, "r") as f:
            content = f.read()
            return f"<pre>{content}</pre>"
    except Exception as e:
        return f"Error: {str(e)}", 500

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=80)
import flask
import requests

app = flask.Flask(__name__)


@app.route("/route/to/resource/<resource_id>")
def resource1(resource_id):
    with open(resource_id) as f:
        pass
    with open(f"/path/to/{resource_id}") as f:
        pass
    with open("/path/to/{0}".format(resource_id)) as f:
        pass
    with open("/path/to/{0}".other(resource_id)) as f:
        pass

@app.route("/route/to/resource/<resource_id>")
def resource2(resource_id):
    file1 = open(resource_id)
    file2 = open(f"/path/to/{resource_id}")
    file3 = open("/path/to/{0}".format(resource_id))


@app.route("/route/to/resource")
def resource2():
    resource_id = flask.request.args.get("resource_id")
    file1 = open(resource_id)
    file2 = open(f"/path/to/{resource_id}")
    file3 = open("/path/to/{0}".format(resource_id))

from flask import Flask, request, render_template


app = Flask(__name__, static_url_path='/static', static_folder='static')
app.config['DEBUG'] = True


@app.route("/")
def start():
    return render_template("index.html")

Compliant Code Examples

import flask
import requests

app = flask.Flask(__name__)

@app.route("/route/to/resource/<resource_id>")
def resource2(resource_id):
    sanitized_resource_id = sanitize(resource_id)
    file1 = open(sanitized_resource_id)
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Integraciones sin problemas. Prueba Datadog Code Security