- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
ID: python-flask/open-file-unsanitized-data
Language: Python
Severity: Error
Category: Security
Use of unsanitized from incoming request, leading to potential data leak and lack of control of the service. Do not use unsanitized data to control file operations. The code should check any incoming data and make sure it’s safe to use it.
import flask
import requests
app = flask.Flask(__name__)
@app.route("/route/to/resource/<resource_id>")
def resource1(resource_id):
with open(resource_id) as f:
pass
with open(f"/path/to/{resource_id}") as f:
pass
with open("/path/to/{0}".format(resource_id)) as f:
pass
with open("/path/to/{0}".other(resource_id)) as f:
pass
@app.route("/route/to/resource/<resource_id>")
def resource2(resource_id):
file1 = open(resource_id)
file2 = open(f"/path/to/{resource_id}")
file3 = open("/path/to/{0}".format(resource_id))
@app.route("/route/to/resource")
def resource2():
resource_id = flask.request.args.get("resource_id")
file1 = open(resource_id)
file2 = open(f"/path/to/{resource_id}")
file3 = open("/path/to/{0}".format(resource_id))
import flask
import requests
app = flask.Flask(__name__)
@app.route("/route/to/resource/<resource_id>")
def resource2(resource_id):
sanitized_resource_id = sanitize(resource_id)
file1 = open(sanitized_resource_id)