python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization

Community Favorite
profile photo of semgrepsemgrep
Author
80,402
Download Count*
LGPL Commons Clause
License

Detected a user-controlled filename that could flow to flask.send_file() function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use flask.send_from_directory

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: avoid_send_file_without_path_sanitization
    patterns:
      - pattern-inside: |
          @app.route(...)
          def $X(filename):
            ...
      - pattern: flask.send_file(filename, ...)
    message: Detected a user-controlled `filename` that could flow to
      `flask.send_file()` function. This could lead to an attacker reading
      arbitrary file from the system, leaking private information. Make sure to
      properly sanitize filename or use `flask.send_from_directory`
    metadata:
      cwe:
        - "CWE-73: External Control of File Name or Path"
      owasp:
        - A04:2021 - Insecure Design
      category: security
      technology:
        - flask
      references:
        - https://owasp.org/Top10/A04_2021-Insecure_Design
      subcategory:
        - audit
      likelihood: LOW
      impact: MEDIUM
      confidence: LOW
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      vulnerability_class:
        - Path Traversal
    languages:
      - python
    severity: WARNING

Examples

secure-static-file-serve.py

from flask import send_file

app = Flask(__name__)

@app.route("/<path:filename>")
def download_file(filename):
  # ruleid:avoid_send_file_without_path_sanitization
  return send_file(filename)

def download_not_flask_route(filename):
  # ok:avoid_send_file_without_path_sanitization
  return send_file(filename)