Do not use template created with strings

문서 > 코드 분석 > Static Analysis Rules > Do not use template created with strings

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Metadata

ID: python-flask/no-render-template-string

Language: Python

Severity: Error

Category: Security

CWE: 96

Description

Using templates created with string leads to server-side injection. Use template based on files.

Learn More

CWE-96: Improper Neutralization of Directives in Statically Saved

Non-Compliant Code Examples

import os
from functools import wraps
from flask import request, redirect, url_for, render_template_string


API_KEY = os.environ.get('VULN_FLASK_APP_API_KEY')

# Decorator to check if user is logged in
def require_api_key(f):
    @wraps(f)
    def wrap(*args, **kwargs):
        api_key = request.cookies.get('api_key')
        if API_KEY is None or api_key == API_KEY:
            return f(*args, **kwargs)
        else:
            return render_template_string('no api key found'), 401
    return wrap