Use of unsanitized data to make API calls

문서 > Datadog 보안 > Code Security > Static Code Analysis (SAST) > SAST 규칙 > Use of unsanitized data to make API calls

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

ID: python-flask/html-format-from-user-input

Language: Python

Severity: Error

Category: Security

CWE: 79

Description

Use of unsanitized from incoming request for SQL queries is unsafe and leads to SQL injections. Data from requests must be sanitized before being used to issues SQL queries, open file or deserialize data. Make sure the data is sanitized before use.

Learn More

CWE-79: Improper Neutralization of Input During Web Page Generation

Non-Compliant Code Examples

import flask
import requests

app = flask.Flask(__name__)


@app.route("/route/to/resource/<resource_id>")
def resource1(resource_id):
    return f"<a href='/path/to/{resource_id}'>Click me!</a>"

@app.route("/route/to/resource/<resource_id>")
def resource2(resource_id):
    return "<a href='/path/to/{0}'>Click me!</a>".format(resource_id)


@app.route("/route/to/resource/<resource_id>")
def resource3():
    resource_id = flask.request.args.get("resource_id")
    return "<a href='/path/to/%s'>Click me!</a>" % resource_id


@app.route("/route/to/resource/<resource_id>")
def resource4(resource_id):
    ret = f"<a href='/path/to/{resource_id}'>Click me!</a>"
    return ret

@app.route("/route/to/resource/<resource_id>")
def resource2():
    resource_id = flask.request.args.get("resource_id")
    ret = "<a href='/path/to/{0}'>Click me!</a>".format(resource_id)
    return ret


@app.route("/route/to/resource/<resource_id>")
def resource3(resource_id):
    ret = "<a href='/path/to/%s'>Click me!</a>" % resource_id
    return ret

Compliant Code Examples

import flask
import requests

app = flask.Flask(__name__)


@app.route("/route/to/resource/<resource_id>")
def resource2(resource_id):
    return "<a href='/path/to/{0}'>Click me!</a>".format(sanitize(resource_id))


@app.route("/route/to/resource/<resource_id>")
def resource2():
    resource_id = get.data()
    ret = requests.get(foo);
    ret = "<a href='/path/to/{0}'>Click me!</a>".format(resource_id)
    return ret