Python: Model FastAPI requests #18318
Conversation
Co-authored-by: Joe Farebrother <[email protected]>
Co-authored-by: Joe Farebrother <[email protected]>
There was a problem hiding this comment.
Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.
Files not reviewed (1)
- python/ql/lib/semmle/python/frameworks/Starlette.qll: Language not supported
Comments suppressed due to low confidence (4)
python/ql/test/library-tests/frameworks/fastapi/taint_test.py:213
- The taint annotation is missing for the data returned by
request.form().getlist("key"). Ensure that this case is covered by the taint analysis.
await request.form().getlist("key"), // $ MISSING: tainted
python/ql/test/library-tests/frameworks/fastapi/taint_test.py:214
- The taint annotation is missing for the first element of the list returned by
request.form().getlist("key"). Ensure that this case is covered by the taint analysis.
await request.form().getlist("key")[0], // $ MISSING: tainted
python/ql/test/library-tests/frameworks/fastapi/taint_test.py:216
- The taint annotation is missing for the filename of the file returned by
request.form()["file"]. Ensure that this case is covered by the taint analysis.
await request.form()["file"].filename, // $ MISSING: tainted
python/ql/test/library-tests/frameworks/fastapi/taint_test.py:217
- The taint annotation is missing for the filename of the first file in the list returned by
request.form().getlist("file"). Ensure that this case is covered by the taint analysis.
await request.form().getlist("file")[0].filename, // $ MISSING: tainted
Tip: If you use Visual Studio Code, you can request a review from Copilot before you push from the "Source Control" tab. Learn more
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| override DataFlow::Node getInstance() { result = instance() } | ||
|
|
||
| override string getAttributeName() { result in ["cookies"] } |
Check warning
Code scanning / CodeQL
Singleton set literal Warning
| await request.form().getlist("key"), # $ MISSING: tainted | ||
| await request.form().getlist("key")[0], # $ MISSING: tainted | ||
| # data in the form could be an starlette.datastructures.UploadFile | ||
| await request.form()["file"].filename, # $ MISSING: tainted | ||
| await request.form().getlist("file")[0].filename, # $ MISSING: tainted |
There was a problem hiding this comment.
For my understanding: These are missing because we don't track flow from the result of form() through to its own properties?
| * Taint propagation for `starlette.requests.Request`. | ||
| */ | ||
| private class InstanceTaintSteps extends InstanceTaintStepsHelper { | ||
| InstanceTaintSteps() { this = "starlette.requests.Request" } |
There was a problem hiding this comment.
For my understanding: This would also apply to fastapi.Request but you're just choosing one qualified name to represent the class right?
| --- | ||
| category: minorAnalysis | ||
| --- | ||
| * Added modeling of `fastapi.Request`, which will improve taint-flow for users of FastAPI. |
There was a problem hiding this comment.
How about this?
| * Added modeling of `fastapi.Request`, which will improve taint-flow for users of FastAPI. | |
| * Added modeling of `fastapi.Request` and `starlette.requests.Request` as sources of untrusted input, | |
| and modeling of tainted data flow out of these request objects. |
Pull Request checklist
All query authors
.qhelp. See the documentation in this repository.Internal query authors only
.ql,.qll, or.qhelpfiles. See the documentation (internal access required).