Use of unsanitized data to open API

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

ID: python-flask/urlopen-unsanitized-data

Language: Python

Severity: Error

Category: Security

CWE: 918

Description

Use of unsanitized from incoming request, leading to potential data leak and lack of control of the service. The code should check any incoming data and make sure it’s safe to use it.

Learn More

Non-Compliant Code Examples

import flask
from urllib.request import urlopen

app = flask.Flask(__name__)



@app.route("/route/to/resource/<resource_id>")
def resource2(resource_id):
    file1 = urlopen(resource_id)
    file2 = urlopen(f"/path/to/{resource_id}")


@app.route("/route/to/resource")
def resource2():
    resource_id = flask.request.args.get("resource_id")
    file1 = urlopen(resource_id)
    file2 = urlopen(f"/path/to/{resource_id}")
    file3 = urlopen("/path/to/{0}".format(resource_id))

Compliant Code Examples

import flask
from urllib.request import urlopen

app = flask.Flask(__name__)

@app.route("/route/to/resource/<resource_id>")
def resource2(resource_id):
    sanitized_resource_id = sanitize(resource_id)
    file1 = urlopen(sanitized_resource_id)
PREVIEWING: aliciascott/DOCS-9725-Cloudcraft