sinkline v0.5.1 · bench/corpus · 2026-11-12 01:42

73findings
43critical
23high
5files
257functions
A01:2021 Broken Access Control15
A02:2021 Cryptographic Failures1
A03:2021 Injection47
A08:2021 Software and Data Integrity Failures6
A09:2021 Security Logging and Monitoring Failures1
A10:2021 Server-Side Request Forgery3
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionfastapi_django_app.py:32:5
route param reaches sqlite3.Connection.execute without a sanitizer for CWE-89.
┌sourcefastapi_django_app.py:31 def read_item(item_id: str): # route parameter `item_id`
│propagatefastapi_django_app.py:32 conn.execute("SELECT * FROM items WHERE id = '" + item_id + "'") # VULN:CWE-89 # concat
└sinkfastapi_django_app.py:32 conn.execute("SELECT * FROM items WHERE id = '" + item_id + "'") # VULN:CWE-89 # sqlite3.Connection.execute
Fix. Use parameterized queries: conn.execute('... WHERE id = ?', (user_id,))
confidence high · source route param · sink sqlite3.Connection.execute · fp a20b79252c49ec08
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionfastapi_django_app.py:44:5
fastapi.Query reaches sqlite3.Connection.execute without a sanitizer for CWE-89.
┌sourcefastapi_django_app.py:43 def search(q: str = Query("")): # fastapi.Query parameter `q`
│propagatefastapi_django_app.py:44 conn.execute("SELECT * FROM items WHERE name LIKE '%" + q + "%'") # VULN:CWE-89 # concat
└sinkfastapi_django_app.py:44 conn.execute("SELECT * FROM items WHERE name LIKE '%" + q + "%'") # VULN:CWE-89 # sqlite3.Connection.execute
Fix. Use parameterized queries: conn.execute('... WHERE id = ?', (user_id,))
confidence high · source fastapi.Query · sink sqlite3.Connection.execute · fp ff4d79804d69d363
CRITICALsubprocess with shell=True and tainted commandSL-CMDI-003 · A03:2021 · CWE-78 · OS Command Injectionfastapi_django_app.py:84:5
fastapi.Form reaches subprocess.run without a sanitizer for CWE-78.
┌sourcefastapi_django_app.py:83 def run(cmd: str = Form(...)): # fastapi.Form parameter `cmd`
└sinkfastapi_django_app.py:84 subprocess.run(cmd, shell=True) # VULN:CWE-78 # subprocess.run
Fix. Drop shell=True and pass an argument list.
confidence high · source fastapi.Form · sink subprocess.run · fp 57df710f6ad5cc56
CRITICALtorch.load on tainted path (pickle-backed)SL-DESER-004 · A08:2021 · CWE-502 · Insecure Deserializationfastapi_django_app.py:98:13
fastapi.Form reaches torch.load without a sanitizer for CWE-502.
┌sourcefastapi_django_app.py:97 def load_model(name: str = Form(...)): # fastapi.Form parameter `name`
│propagatefastapi_django_app.py:98 model = torch.load(MODEL_DIR / name) # VULN:CWE-502 # concat
└sinkfastapi_django_app.py:98 model = torch.load(MODEL_DIR / name) # VULN:CWE-502 # torch.load
Fix. Use weights_only=True or safetensors.
confidence high · source fastapi.Form · sink torch.load · fp 069d4c1cec3e876a
CRITICALyaml.load without SafeLoader on tainted dataSL-DESER-003 · A08:2021 · CWE-502 · Insecure Deserializationfastapi_django_app.py:124:12
fastapi.Form reaches yaml.load without a sanitizer for CWE-502.
┌sourcefastapi_django_app.py:123 def cfg(text: str = Form(...)): # fastapi.Form parameter `text`
└sinkfastapi_django_app.py:124 return yaml.load(text, Loader=yaml.FullLoader) # VULN:CWE-502 # yaml.load
Fix. Use yaml.safe_load(data).
confidence high · source fastapi.Form · sink yaml.load · fp 17aa9f127f277ce1
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionfastapi_django_app.py:154:9
request param.GET reaches django.db.connection.cursor.execute without a sanitizer for CWE-89.
┌sourcefastapi_django_app.py:154 c.execute("SELECT 1 WHERE x = '%s'" % request.GET["x"]) # VULN:CWE-89 # request param.GET
│propagatefastapi_django_app.py:154 c.execute("SELECT 1 WHERE x = '%s'" % request.GET["x"]) # VULN:CWE-89 # %-format
└sinkfastapi_django_app.py:154 c.execute("SELECT 1 WHERE x = '%s'" % request.GET["x"]) # VULN:CWE-89 # django.db.connection.cursor.execute
confidence high · source request param.GET · sink django.db.connection.cursor.execute · fp 2be8efdee7f080f4
CRITICALOS command built from tainted dataSL-CMDI-001 · A03:2021 · CWE-78 · OS Command Injectionfastapi_django_app.py:172:5
sys.argv reaches os.system without a sanitizer for CWE-78.
┌sourcefastapi_django_app.py:171 target = sys.argv[1] # sys.argv
│propagatefastapi_django_app.py:171 target = sys.argv[1] # assigned to `target`
│propagatefastapi_django_app.py:172 os.system("nmap " + target) # VULN:CWE-78 # concat
└sinkfastapi_django_app.py:172 os.system("nmap " + target) # VULN:CWE-78 # os.system
Fix. Use subprocess.run([...], shell=False) with an argument list.
confidence high · source sys.argv · sink os.system · fp c31613e0e9b3ba95
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionfastapi_django_app.py:198:12
route param reaches execute (inside Store.get, fastapi_django_app.py:190) without a sanitizer for CWE-89.
┌sourcefastapi_django_app.py:197 def kv(key: str): # route parameter `key`
│callfastapi_django_app.py:198 return Store(conn).get(key) # VULN:CWE-89 # passed as `key` to Store.get()
└sinkfastapi_django_app.py:190 return self.c.execute("SELECT v FROM kv WHERE k = '" + key + "'") # sink inside method # execute inside Store.get()
Fix. Use parameterized queries; never format user input into the SQL string.
confidence medium · source route param · sink execute · fp 4e08ec67443bcf8d
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionflask_app.py:34:5
flask.request.args reaches sqlite3.Cursor.execute without a sanitizer for CWE-89.
┌sourceflask_app.py:32 uid = request.args.get("id") # flask.request.args
│propagateflask_app.py:32 uid = request.args.get("id") # .get()
│propagateflask_app.py:34 cur.execute("SELECT * FROM users WHERE id = " + uid) # VULN:CWE-89 # concat
└sinkflask_app.py:34 cur.execute("SELECT * FROM users WHERE id = " + uid) # VULN:CWE-89 # sqlite3.Cursor.execute
Fix. Use parameterized queries: cursor.execute('... WHERE id = ?', (user_id,))
confidence high · source flask.request.args · sink sqlite3.Cursor.execute · fp de2d6945453fbde8
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionflask_app.py:57:5
flask.request.form reaches sqlite3.Connection.execute without a sanitizer for CWE-89.
┌sourceflask_app.py:55 q = request.form["q"] # flask.request.form
│propagateflask_app.py:55 q = request.form["q"] # assigned to `q`
│propagateflask_app.py:56 sql = "SELECT * FROM t WHERE name LIKE '%%%s%%'" % q # %-format
└sinkflask_app.py:57 db.execute(sql) # VULN:CWE-89 # sqlite3.Connection.execute
Fix. Use parameterized queries: conn.execute('... WHERE id = ?', (user_id,))
confidence high · source flask.request.form · sink sqlite3.Connection.execute · fp e112cce060be8e10
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionflask_app.py:67:5
flask.request.args reaches sqlite3.Connection.execute (inside _lookup, flask_app.py:62) without a sanitizer for CWE-89.
┌sourceflask_app.py:67 _lookup(request.args["name"]) # VULN:CWE-89 # flask.request.args
│callflask_app.py:67 _lookup(request.args["name"]) # VULN:CWE-89 # passed as `name` to _lookup()
└sinkflask_app.py:62 return db.execute("SELECT * FROM t WHERE name = '" + name + "'") # sink inside helper # sqlite3.Connection.execute inside _lookup()
Fix. Use parameterized queries: conn.execute('... WHERE id = ?', (user_id,))
confidence medium · source flask.request.args · sink sqlite3.Connection.execute · fp b7e80c48a3f9994f
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionflask_app.py:95:9
flask.request.args reaches sqlite3.Connection.execute without a sanitizer for CWE-89.
┌sourceflask_app.py:91 uid = request.args.get("id") # flask.request.args
│propagateflask_app.py:91 uid = request.args.get("id") # .get()
│propagateflask_app.py:95 db.execute("SELECT * FROM users WHERE id = " + uid) # VULN:CWE-89 # concat
└sinkflask_app.py:95 db.execute("SELECT * FROM users WHERE id = " + uid) # VULN:CWE-89 # sqlite3.Connection.execute
Fix. Use parameterized queries: conn.execute('... WHERE id = ?', (user_id,))
confidence high · source flask.request.args · sink sqlite3.Connection.execute · fp a106af4c53bca1fd
CRITICALOS command built from tainted dataSL-CMDI-001 · A03:2021 · CWE-78 · OS Command Injectionflask_app.py:104:5
flask.request.args reaches os.system without a sanitizer for CWE-78.
┌sourceflask_app.py:103 host = request.args["host"] # flask.request.args
│propagateflask_app.py:103 host = request.args["host"] # assigned to `host`
│propagateflask_app.py:104 os.system("ping -c 1 " + host) # VULN:CWE-78 # concat
└sinkflask_app.py:104 os.system("ping -c 1 " + host) # VULN:CWE-78 # os.system
Fix. Use subprocess.run([...], shell=False) with an argument list.
confidence high · source flask.request.args · sink os.system · fp e29609cf078b202f
CRITICALsubprocess with shell=True and tainted commandSL-CMDI-003 · A03:2021 · CWE-78 · OS Command Injectionflask_app.py:118:5
flask.request.args reaches subprocess.run without a sanitizer for CWE-78.
┌sourceflask_app.py:117 host = request.args["host"] # flask.request.args
│propagateflask_app.py:117 host = request.args["host"] # assigned to `host`
│propagateflask_app.py:118 subprocess.run("ping -c 1 " + host, shell=True) # VULN:CWE-78 # concat
└sinkflask_app.py:118 subprocess.run("ping -c 1 " + host, shell=True) # VULN:CWE-78 # subprocess.run
Fix. Drop shell=True and pass an argument list.
confidence high · source flask.request.args · sink subprocess.run · fp 1821c5f86627a184
CRITICALsubprocess with shell=True and tainted commandSL-CMDI-003 · A03:2021 · CWE-78 · OS Command Injectionflask_app.py:132:5
flask.request.args reaches subprocess.Popen without a sanitizer for CWE-78.
┌sourceflask_app.py:131 host = request.args["host"].strip().lower() # flask.request.args
│propagateflask_app.py:131 host = request.args["host"].strip().lower() # .strip()
│propagateflask_app.py:132 subprocess.Popen(f"dig {host}", shell=True) # VULN:CWE-78 # f-string
└sinkflask_app.py:132 subprocess.Popen(f"dig {host}", shell=True) # VULN:CWE-78 # subprocess.Popen
Fix. Drop shell=True and pass an argument list.
confidence high · source flask.request.args · sink subprocess.Popen · fp adf86ca47742d346
CRITICALeval() of tainted dataSL-CODE-001 · A03:2021 · CWE-95 · Code Injectionflask_app.py:157:16
flask.request.args reaches builtins.eval without a sanitizer for CWE-95.
┌sourceflask_app.py:156 expr = request.args["expr"] # flask.request.args
│propagateflask_app.py:156 expr = request.args["expr"] # assigned to `expr`
└sinkflask_app.py:157 return str(eval(expr)) # VULN:CWE-95 # builtins.eval
Fix. Use ast.literal_eval for data, or a whitelist dispatch for operations.
confidence high · source flask.request.args · sink builtins.eval · fp 22b7c7002268287e
CRITICALServer-side template injectionSL-SSTI-001 · A03:2021 · CWE-1336 · Server-Side Template Injectionflask_app.py:169:12
flask.request.args reaches flask.render_template_string without a sanitizer for CWE-1336.
┌sourceflask_app.py:168 name = request.args.get("name", "") # flask.request.args
│propagateflask_app.py:168 name = request.args.get("name", "") # .get()
│propagateflask_app.py:169 return render_template_string("<h1>Hello " + name + "</h1>") # VULN:CWE-1336 # concat
└sinkflask_app.py:169 return render_template_string("<h1>Hello " + name + "</h1>") # VULN:CWE-1336 # flask.render_template_string
Fix. Pass user data as template *variables*, never into the template source.
confidence high · source flask.request.args · sink flask.render_template_string · fp dd01b82b72dd9aaf
CRITICALDeserialization of tainted data (pickle)SL-DESER-001 · A08:2021 · CWE-502 · Insecure Deserializationflask_app.py:289:20
flask.request.data reaches pickle.loads without a sanitizer for CWE-502.
┌sourceflask_app.py:289 return jsonify(pickle.loads(request.data)) # VULN:CWE-502 # flask.request.data
└sinkflask_app.py:289 return jsonify(pickle.loads(request.data)) # VULN:CWE-502 # pickle.loads
Fix. Never unpickle untrusted bytes. Use JSON or a schema-validated format.
confidence high · source flask.request.data · sink pickle.loads · fp 38b550fc00f728ff
CRITICALyaml.load without SafeLoader on tainted dataSL-DESER-003 · A08:2021 · CWE-502 · Insecure Deserializationflask_app.py:294:20
flask.request.data reaches yaml.load without a sanitizer for CWE-502.
┌sourceflask_app.py:294 return jsonify(yaml.load(request.data)) # VULN:CWE-502 # flask.request.data
└sinkflask_app.py:294 return jsonify(yaml.load(request.data)) # VULN:CWE-502 # yaml.load
Fix. Use yaml.safe_load(data).
confidence high · source flask.request.data · sink yaml.load · fp 5854565f1d8e599f
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionhard_app.py:28:5
flask.request.args reaches sqlite3.Connection.execute without a sanitizer for CWE-89.
┌sourcehard_app.py:28 db.execute(build_query(request.args["name"])) # VULN:CWE-89 # flask.request.args
│callhard_app.py:28 db.execute(build_query(request.args["name"])) # VULN:CWE-89 # through build_query()
└sinkhard_app.py:28 db.execute(build_query(request.args["name"])) # VULN:CWE-89 # sqlite3.Connection.execute
Fix. Use parameterized queries: conn.execute('... WHERE id = ?', (user_id,))
confidence high · source flask.request.args · sink sqlite3.Connection.execute · fp 5c760a54c7516e0c
CRITICALsubprocess with shell=True and tainted commandSL-CMDI-003 · A03:2021 · CWE-78 · OS Command Injectionhard_app.py:34:5
flask.request.args reaches subprocess.call (inside Shell.run, hard_helpers.py:17) without a sanitizer for CWE-78.
┌sourcehard_app.py:34 Shell().run(request.args["cmd"]) # VULN:CWE-78 # flask.request.args
│callhard_app.py:34 Shell().run(request.args["cmd"]) # VULN:CWE-78 # passed as `cmd` to Shell.run()
└sinkhard_helpers.py:17 subprocess.call(cmd, shell=True) # subprocess.call inside Shell.run()
confidence medium · source flask.request.args · sink subprocess.call · fp 73da29bfd34283f6
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionhard_app.py:46:5
flask.request.args reaches sqlite3.Connection.execute (inside _exec, hard_helpers.py:25) without a sanitizer for CWE-89.
┌sourcehard_app.py:46 lookup_user(request.args["id"]) # VULN:CWE-89 (sink two hops deep) # flask.request.args
│callhard_app.py:46 lookup_user(request.args["id"]) # VULN:CWE-89 (sink two hops deep) # passed as `uid` to lookup_user()
└sinkhard_helpers.py:25 _db.execute(sql) # sqlite3.Connection.execute inside _exec()
Fix. Use parameterized queries: conn.execute('... WHERE id = ?', (user_id,))
confidence medium · source flask.request.args · sink sqlite3.Connection.execute · fp 8366a8b91ec8d40f
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionhard_app.py:61:5
flask.request.args reaches sqlite3.Connection.execute without a sanitizer for CWE-89.
┌sourcehard_app.py:60 params = {"name": request.args["n"]} # flask.request.args
│propagatehard_app.py:61 db.execute("SELECT * FROM t WHERE n = '" + params["name"] + "'") # VULN:CWE-89 # ['name']
└sinkhard_app.py:61 db.execute("SELECT * FROM t WHERE n = '" + params["name"] + "'") # VULN:CWE-89 # sqlite3.Connection.execute
Fix. Use parameterized queries: conn.execute('... WHERE id = ?', (user_id,))
confidence high · source flask.request.args · sink sqlite3.Connection.execute · fp f6220e8c65fdb61e
CRITICALsubprocess with shell=True and tainted commandSL-CMDI-003 · A03:2021 · CWE-78 · OS Command Injectionhard_app.py:70:5
flask.request.args reaches subprocess.run without a sanitizer for CWE-78.
┌sourcehard_app.py:69 parts.append(request.args[k]) # flask.request.args
│propagatehard_app.py:69 parts.append(request.args[k]) # .append() into `parts`
│propagatehard_app.py:70 subprocess.run(" ".join(parts), shell=True) # VULN:CWE-78 # str.join()
└sinkhard_app.py:70 subprocess.run(" ".join(parts), shell=True) # VULN:CWE-78 # subprocess.run
Fix. Drop shell=True and pass an argument list.
confidence high · source flask.request.args · sink subprocess.run · fp 7c4e570183117cd6
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionhard_app.py:91:5
flask.request.args reaches sqlite3.Connection.execute without a sanitizer for CWE-89.
┌sourcehard_app.py:90 names = [n.strip() for n in request.args.getlist("n")] # flask.request.args
│propagatehard_app.py:90 names = [n.strip() for n in request.args.getlist("n")] # .getlist()
│propagatehard_app.py:91 db.execute("SELECT * FROM t WHERE n IN (" + ",".join(names) + ")") # VULN:CWE-89 # str.join()
└sinkhard_app.py:91 db.execute("SELECT * FROM t WHERE n IN (" + ",".join(names) + ")") # VULN:CWE-89 # sqlite3.Connection.execute
Fix. Use parameterized queries: conn.execute('... WHERE id = ?', (user_id,))
confidence high · source flask.request.args · sink sqlite3.Connection.execute · fp 5d29a7006b47b3cb
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionhard_app.py:115:5
flask.request.args reaches sqlite3.Connection.execute without a sanitizer for CWE-89.
┌sourcehard_app.py:110 uid = request.args.get("id") # flask.request.args
│propagatehard_app.py:110 uid = request.args.get("id") # .get()
│propagatehard_app.py:115 db.execute("SELECT * FROM users WHERE id = " + uid) # VULN:CWE-89 (uid itself never converted) # concat
└sinkhard_app.py:115 db.execute("SELECT * FROM users WHERE id = " + uid) # VULN:CWE-89 (uid itself never converted) # sqlite3.Connection.execute
Fix. Use parameterized queries: conn.execute('... WHERE id = ?', (user_id,))
confidence high · source flask.request.args · sink sqlite3.Connection.execute · fp acd2d6987789173b
CRITICALOS command built from tainted dataSL-CMDI-001 · A03:2021 · CWE-78 · OS Command Injectionhard_app.py:148:5
flask.request.args reaches os.system without a sanitizer for CWE-78.
┌sourcehard_app.py:145 cmd = cmd + request.args.get("flag", "") # flask.request.args
│propagatehard_app.py:145 cmd = cmd + request.args.get("flag", "") # .get()
└sinkhard_app.py:148 os.system(cmd) # VULN:CWE-78 # os.system
Fix. Use subprocess.run([...], shell=False) with an argument list.
confidence high · source flask.request.args · sink os.system · fp 636c025246befb09
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionhard_app.py:155:9
flask.request.args reaches sqlite3.Connection.execute without a sanitizer for CWE-89.
┌sourcehard_app.py:154 if (q := request.args.get("q")) is not None: # flask.request.args
│propagatehard_app.py:154 if (q := request.args.get("q")) is not None: # .get()
│propagatehard_app.py:155 db.execute("SELECT * FROM t WHERE q = '" + q + "'") # VULN:CWE-89 # concat
└sinkhard_app.py:155 db.execute("SELECT * FROM t WHERE q = '" + q + "'") # VULN:CWE-89 # sqlite3.Connection.execute
Fix. Use parameterized queries: conn.execute('... WHERE id = ?', (user_id,))
confidence high · source flask.request.args · sink sqlite3.Connection.execute · fp ca70066929732dbd
CRITICALOS command built from tainted dataSL-CMDI-001 · A03:2021 · CWE-78 · OS Command Injectionhard_app.py:183:9
flask.request.args reaches os.system without a sanitizer for CWE-78.
┌sourcehard_app.py:180 self.target = request.args.get("target") # flask.request.args
│propagatehard_app.py:180 self.target = request.args.get("target") # .get()
│propagatehard_app.py:180 self.target = request.args.get("target") # stored in `self.target` by Handler.load()
│propagatehard_app.py:183 os.system("ping " + self.target) # VULN:CWE-78 (field set in load(), used in fire()) # read `self.target` in Handler.fire()
└sinkhard_app.py:183 os.system("ping " + self.target) # VULN:CWE-78 (field set in load(), used in fire()) # os.system
Fix. Use subprocess.run([...], shell=False) with an argument list.
confidence medium · source flask.request.args · sink os.system · fp c6c40c7581732267
CRITICALOS command built from tainted dataSL-CMDI-001 · A03:2021 · CWE-78 · OS Command Injectionhard_app.py:193:5
flask.request.args reaches os.system (inside Handler.direct, hard_app.py:187) without a sanitizer for CWE-78.
┌sourcehard_app.py:193 h.direct(request.args["t"]) # VULN:CWE-78 # flask.request.args
│callhard_app.py:193 h.direct(request.args["t"]) # VULN:CWE-78 # passed as `t` to Handler.direct()
└sinkhard_app.py:187 os.system("ping " + self.t) # sink via self.t # os.system inside Handler.direct()
Fix. Use subprocess.run([...], shell=False) with an argument list.
confidence medium · source flask.request.args · sink os.system · fp 355f15fdc8eb3252
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionhard_app.py:202:5
flask.request.args reaches sqlite3.Connection.execute without a sanitizer for CWE-89.
┌sourcehard_app.py:202 db.execute("SELECT " + request.args.get("x")) # VULN:CWE-89 # flask.request.args
│propagatehard_app.py:202 db.execute("SELECT " + request.args.get("x")) # VULN:CWE-89 # .get()
└sinkhard_app.py:202 db.execute("SELECT " + request.args.get("x")) # VULN:CWE-89 # sqlite3.Connection.execute
Fix. Use parameterized queries: conn.execute('... WHERE id = ?', (user_id,))
confidence high · source flask.request.args · sink sqlite3.Connection.execute · fp cad75eb055327cf8
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionhard_app.py:211:16
flask.request.args reaches sqlite3.Connection.execute without a sanitizer for CWE-89.
┌sourcehard_app.py:208 raw = request.args.get("q") # flask.request.args
│propagatehard_app.py:208 raw = request.args.get("q") # .get()
│propagatehard_app.py:211 return db.execute("SELECT " + raw) # VULN:CWE-89 (closure captures outer taint) # concat
└sinkhard_app.py:211 return db.execute("SELECT " + raw) # VULN:CWE-89 (closure captures outer taint) # sqlite3.Connection.execute
Fix. Use parameterized queries: conn.execute('... WHERE id = ?', (user_id,))
confidence high · source flask.request.args · sink sqlite3.Connection.execute · fp 81c93e19dac7f6b4
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionhard_app.py:232:5
flask.request.args reaches sqlite3.Connection.execute without a sanitizer for CWE-89.
┌sourcehard_app.py:232 db.execute("SELECT * FROM t WHERE n = '{}'".format(request.args["n"])) # VULN:CWE-89 # flask.request.args
│propagatehard_app.py:232 db.execute("SELECT * FROM t WHERE n = '{}'".format(request.args["n"])) # VULN:CWE-89 # str.format()
└sinkhard_app.py:232 db.execute("SELECT * FROM t WHERE n = '{}'".format(request.args["n"])) # VULN:CWE-89 # sqlite3.Connection.execute
Fix. Use parameterized queries: conn.execute('... WHERE id = ?', (user_id,))
confidence high · source flask.request.args · sink sqlite3.Connection.execute · fp d7fa7f4834c1aff6
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionhard_app.py:238:5
flask.request.args reaches sqlite3.Connection.execute without a sanitizer for CWE-89.
┌sourcehard_app.py:238 db.execute("SELECT * FROM t WHERE n = '{n}'".format(n=request.args["n"])) # VULN:CWE-89 # flask.request.args
│propagatehard_app.py:238 db.execute("SELECT * FROM t WHERE n = '{n}'".format(n=request.args["n"])) # VULN:CWE-89 # str.format()
└sinkhard_app.py:238 db.execute("SELECT * FROM t WHERE n = '{n}'".format(n=request.args["n"])) # VULN:CWE-89 # sqlite3.Connection.execute
Fix. Use parameterized queries: conn.execute('... WHERE id = ?', (user_id,))
confidence high · source flask.request.args · sink sqlite3.Connection.execute · fp 859531a5e64f839c
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionhard_app.py:244:5
flask.request.args reaches sqlite3.Connection.execute without a sanitizer for CWE-89.
┌sourcehard_app.py:244 db.execute("SELECT * FROM t WHERE n = '%(n)s'" % {"n": request.args["n"]}) # VULN:CWE-89 # flask.request.args
│propagatehard_app.py:244 db.execute("SELECT * FROM t WHERE n = '%(n)s'" % {"n": request.args["n"]}) # VULN:CWE-89 # %-format
└sinkhard_app.py:244 db.execute("SELECT * FROM t WHERE n = '%(n)s'" % {"n": request.args["n"]}) # VULN:CWE-89 # sqlite3.Connection.execute
Fix. Use parameterized queries: conn.execute('... WHERE id = ?', (user_id,))
confidence high · source flask.request.args · sink sqlite3.Connection.execute · fp 05c3ec1370c8cabd
CRITICALsubprocess with shell=True and tainted commandSL-CMDI-003 · A03:2021 · CWE-78 · OS Command Injectionhard_app.py:257:5
flask.request.args reaches subprocess.run without a sanitizer for CWE-78.
┌sourcehard_app.py:257 subprocess.run(args="ls " + request.args["d"], shell=True) # VULN:CWE-78 # flask.request.args
│propagatehard_app.py:257 subprocess.run(args="ls " + request.args["d"], shell=True) # VULN:CWE-78 # concat
└sinkhard_app.py:257 subprocess.run(args="ls " + request.args["d"], shell=True) # VULN:CWE-78 # subprocess.run
Fix. Drop shell=True and pass an argument list.
confidence high · source flask.request.args · sink subprocess.run · fp a35ba93de23bcdcf
CRITICALOS command built from tainted dataSL-CMDI-001 · A03:2021 · CWE-78 · OS Command Injectionhard_app.py:270:5
flask.request.data reaches os.system without a sanitizer for CWE-78.
┌sourcehard_app.py:269 data = json.loads(request.data) # flask.request.data
│propagatehard_app.py:269 data = json.loads(request.data) # json.loads()
│propagatehard_app.py:270 os.system("echo " + data["msg"]) # VULN:CWE-78 # concat
└sinkhard_app.py:270 os.system("echo " + data["msg"]) # VULN:CWE-78 # os.system
Fix. Use subprocess.run([...], shell=False) with an argument list.
confidence high · source flask.request.data · sink os.system · fp 454a1c7250474d36
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionsmoke_app.py:22:12
flask.request.args reaches sqlite3.Cursor.execute (inside run_query, smoke_app.py:10) without a sanitizer for CWE-89.
┌sourcesmoke_app.py:21 uid = request.args.get("id") # flask.request.args
│propagatesmoke_app.py:21 uid = request.args.get("id") # .get()
│propagatesmoke_app.py:22 return run_query("SELECT * FROM users WHERE id = " + uid) # SQLi via helper # concat
│callsmoke_app.py:22 return run_query("SELECT * FROM users WHERE id = " + uid) # SQLi via helper # passed as `sql` to run_query()
└sinksmoke_app.py:10 cur.execute(sql) # sink inside helper # sqlite3.Cursor.execute inside run_query()
Fix. Use parameterized queries: cursor.execute('... WHERE id = ?', (user_id,))
confidence medium · source flask.request.args · sink sqlite3.Cursor.execute · fp 963fe6c669c308cc
CRITICALsubprocess with shell=True and tainted commandSL-CMDI-003 · A03:2021 · CWE-78 · OS Command Injectionsmoke_app.py:32:5
flask.request.args reaches subprocess.run without a sanitizer for CWE-78.
┌sourcesmoke_app.py:31 host = normalize(request.args["host"]) # flask.request.args
│callsmoke_app.py:31 host = normalize(request.args["host"]) # through normalize()
│propagatesmoke_app.py:31 host = normalize(request.args["host"]) # assigned to `host`
│propagatesmoke_app.py:32 subprocess.run("ping -c1 " + host, shell=True) # CMDi through normalize() # concat
└sinksmoke_app.py:32 subprocess.run("ping -c1 " + host, shell=True) # CMDi through normalize() # subprocess.run
Fix. Drop shell=True and pass an argument list.
confidence high · source flask.request.args · sink subprocess.run · fp de91acbac6580cce
CRITICALServer-side template injectionSL-SSTI-001 · A03:2021 · CWE-1336 · Server-Side Template Injectionsmoke_app.py:63:12
flask.request.args reaches flask.render_template_string without a sanitizer for CWE-1336.
┌sourcesmoke_app.py:63 return render_template_string("<h1>Hi " + request.args.get("n") + "</h1>") # SSTI # flask.request.args
│propagatesmoke_app.py:63 return render_template_string("<h1>Hi " + request.args.get("n") + "</h1>") # SSTI # .get()
└sinksmoke_app.py:63 return render_template_string("<h1>Hi " + request.args.get("n") + "</h1>") # SSTI # flask.render_template_string
Fix. Pass user data as template *variables*, never into the template source.
confidence high · source flask.request.args · sink flask.render_template_string · fp 115a2fe42df7824a
CRITICALDeserialization of tainted data (pickle)SL-DESER-001 · A08:2021 · CWE-502 · Insecure Deserializationsmoke_app.py:71:11
flask.request.data reaches pickle.loads without a sanitizer for CWE-502.
┌sourcesmoke_app.py:71 obj = pickle.loads(request.data) # deser # flask.request.data
└sinksmoke_app.py:71 obj = pickle.loads(request.data) # deser # pickle.loads
Fix. Never unpickle untrusted bytes. Use JSON or a schema-validated format.
confidence high · source flask.request.data · sink pickle.loads · fp cf1969b29b66db24
CRITICALyaml.load without SafeLoader on tainted dataSL-DESER-003 · A08:2021 · CWE-502 · Insecure Deserializationsmoke_app.py:72:11
flask.request.data reaches yaml.load without a sanitizer for CWE-502.
┌sourcesmoke_app.py:72 cfg = yaml.load(request.data) # unsafe yaml # flask.request.data
└sinksmoke_app.py:72 cfg = yaml.load(request.data) # unsafe yaml # yaml.load
Fix. Use yaml.safe_load(data).
confidence high · source flask.request.data · sink yaml.load · fp d0804eb06118d5cd
CRITICALSQL built from tainted dataSL-SQLI-001 · A03:2021 · CWE-89 · SQL Injectionsmoke_app.py:89:16
flask.request.args reaches conn.execute (inside Repo.find, smoke_app.py:85) without a sanitizer for CWE-89.
┌sourcesmoke_app.py:89 return str(Repo(db).find(request.args["n"])) # SQLi via method # flask.request.args
│callsmoke_app.py:89 return str(Repo(db).find(request.args["n"])) # SQLi via method # passed as `name` to Repo.find()
└sinksmoke_app.py:85 return self.conn.execute("SELECT * FROM t WHERE n = '%s'" % name) # conn.execute inside Repo.find()
confidence medium · source flask.request.args · sink conn.execute · fp 327ea020c6652fdb
HIGHReflected XSS: tainted body in HTTP responseSL-XSS-003 · A03:2021 · CWE-79 · Cross-Site Scriptingfastapi_django_app.py:56:12
fastapi.Query reaches fastapi.responses.HTMLResponse without a sanitizer for CWE-79.
┌sourcefastapi_django_app.py:55 def page(name: str = Query("")): # fastapi.Query parameter `name`
│propagatefastapi_django_app.py:56 return HTMLResponse("<h1>" + name + "</h1>") # VULN:CWE-79 # concat
└sinkfastapi_django_app.py:56 return HTMLResponse("<h1>" + name + "</h1>") # VULN:CWE-79 # fastapi.responses.HTMLResponse
confidence high · source fastapi.Query · sink fastapi.responses.HTMLResponse · fp e5d6198aab4cf39d
HIGHPath traversal: tainted path servedSL-PATH-005 · A01:2021 · CWE-22 · Path Traversalfastapi_django_app.py:71:12
route param reaches fastapi.responses.FileResponse without a sanitizer for CWE-22.
┌sourcefastapi_django_app.py:70 def files(name: str): # route parameter `name`
│propagatefastapi_django_app.py:71 return FileResponse(MODEL_DIR / name) # VULN:CWE-22 # concat
└sinkfastapi_django_app.py:71 return FileResponse(MODEL_DIR / name) # VULN:CWE-22 # fastapi.responses.FileResponse
confidence high · source route param · sink fastapi.responses.FileResponse · fp 623f8ed000243d78
HIGHTar Slip: extractall of tainted archiveSL-PATH-009 · A01:2021 · CWE-22 · Path Traversalfastapi_django_app.py:111:9
fastapi.Form reaches tarfile.TarFile.extractall without a sanitizer for CWE-22.
┌sourcefastapi_django_app.py:109 def upload_archive(path: str = Form(...)): # fastapi.Form parameter `path`
│callfastapi_django_app.py:110 with tarfile.open(path) as tf: # tarfile.open() (unknown; assumed passthrough)
│propagatefastapi_django_app.py:110 with tarfile.open(path) as tf: # assigned to `tf`
└sinkfastapi_django_app.py:111 tf.extractall("/tmp/out") # VULN:CWE-22 # tarfile.TarFile.extractall
Fix. Use filter='data' (Python 3.12+) or validate each member path.
confidence medium · source fastapi.Form · sink tarfile.TarFile.extractall · fp d4ab4ff25ac031bc
HIGHZip Slip: extractall of tainted archiveSL-PATH-009 · A01:2021 · CWE-22 · Path Traversalfastapi_django_app.py:118:9
fastapi.Form reaches zipfile.ZipFile.extractall without a sanitizer for CWE-22.
┌sourcefastapi_django_app.py:116 def upload_zip(path: str = Form(...)): # fastapi.Form parameter `path`
│callfastapi_django_app.py:117 with zipfile.ZipFile(path) as zf: # zipfile.ZipFile() (unknown; assumed passthrough)
│propagatefastapi_django_app.py:117 with zipfile.ZipFile(path) as zf: # assigned to `zf`
└sinkfastapi_django_app.py:118 zf.extractall("/tmp/out") # VULN:CWE-22 # zipfile.ZipFile.extractall
Fix. Validate each member: reject absolute paths and '..' before extracting.
confidence medium · source fastapi.Form · sink zipfile.ZipFile.extractall · fp 1d112ba805a99cb2
HIGHReflected XSS: tainted body in HTTP responseSL-XSS-003 · A03:2021 · CWE-79 · Cross-Site Scriptingfastapi_django_app.py:131:12
request param.GET reaches django.http.HttpResponse without a sanitizer for CWE-79.
┌sourcefastapi_django_app.py:130 name = request.GET.get("name", "") # request param.GET
│propagatefastapi_django_app.py:130 name = request.GET.get("name", "") # .get()
│propagatefastapi_django_app.py:131 return HttpResponse("<h1>" + name + "</h1>") # VULN:CWE-79 # concat
└sinkfastapi_django_app.py:131 return HttpResponse("<h1>" + name + "</h1>") # VULN:CWE-79 # django.http.HttpResponse
confidence high · source request param.GET · sink django.http.HttpResponse · fp fd0c01eb976caa73
HIGHTainted data marked safe for HTMLSL-XSS-001 · A03:2021 · CWE-79 · Cross-Site Scriptingfastapi_django_app.py:140:12
request param.POST reaches django.utils.safestring.mark_safe without a sanitizer for CWE-79.
┌sourcefastapi_django_app.py:140 return mark_safe(request.POST["html"]) # VULN:CWE-79 # request param.POST
└sinkfastapi_django_app.py:140 return mark_safe(request.POST["html"]) # VULN:CWE-79 # django.utils.safestring.mark_safe
confidence high · source request param.POST · sink django.utils.safestring.mark_safe · fp a167b2b55013b0aa
HIGHPath traversal: tainted path openedSL-PATH-001 · A01:2021 · CWE-22 · Path Traversalfastapi_django_app.py:173:10
sys.argv reaches builtins.open without a sanitizer for CWE-22.
┌sourcefastapi_django_app.py:171 target = sys.argv[1] # sys.argv
│propagatefastapi_django_app.py:171 target = sys.argv[1] # assigned to `target`
└sinkfastapi_django_app.py:173 with open(target) as fh: # VULN:CWE-22 # builtins.open
Fix. Resolve against a base dir and reject if not under it: p = (BASE / name).resolve(); p.relative_to(BASE)
confidence high · source sys.argv · sink builtins.open · fp a8b32938bf9b35ed
HIGHReflected XSS: tainted body in HTTP responseSL-XSS-003 · A03:2021 · CWE-79 · Cross-Site Scriptingflask_app.py:169:12
flask.request.args reaches flask.render_template_string without a sanitizer for CWE-79.
┌sourceflask_app.py:168 name = request.args.get("name", "") # flask.request.args
│propagateflask_app.py:168 name = request.args.get("name", "") # .get()
│propagateflask_app.py:169 return render_template_string("<h1>Hello " + name + "</h1>") # VULN:CWE-1336 # concat
└sinkflask_app.py:169 return render_template_string("<h1>Hello " + name + "</h1>") # VULN:CWE-1336 # flask.render_template_string
Fix. Keep the template a constant and pass user data as variables so Jinja auto-escapes it.
confidence high · source flask.request.args · sink flask.render_template_string · fp 4b25d199c26dad87
HIGHReflected XSS: tainted string returned from viewSL-XSS-004 · A03:2021 · CWE-79 · Cross-Site Scriptingflask_app.py:187:5
flask.request.args reaches __return_http__ without a sanitizer for CWE-79.
┌sourceflask_app.py:186 name = request.args.get("name", "") # flask.request.args
│propagateflask_app.py:186 name = request.args.get("name", "") # .get()
│propagateflask_app.py:187 return "<p>Hi " + name + "</p>" # VULN:CWE-79 # concat
└sinkflask_app.py:187 return "<p>Hi " + name + "</p>" # VULN:CWE-79 # __return_http__
Fix. Return a rendered template or escape the value with markupsafe.escape().
confidence high · source flask.request.args · sink __return_http__ · fp 51b9fbac36b0dee1
HIGHTainted data marked safe for HTMLSL-XSS-001 · A03:2021 · CWE-79 · Cross-Site Scriptingflask_app.py:199:12
flask.request.args reaches flask.Markup without a sanitizer for CWE-79.
┌sourceflask_app.py:198 name = request.args.get("name", "") # flask.request.args
│propagateflask_app.py:198 name = request.args.get("name", "") # .get()
│propagateflask_app.py:199 return Markup("<b>" + name + "</b>") # VULN:CWE-79 # concat
└sinkflask_app.py:199 return Markup("<b>" + name + "</b>") # VULN:CWE-79 # flask.Markup
Fix. Let the template auto-escape; only mark trusted constant HTML as safe.
confidence high · source flask.request.args · sink flask.Markup · fp a3460ea44c598b03
HIGHReflected XSS: tainted body in HTTP responseSL-XSS-003 · A03:2021 · CWE-79 · Cross-Site Scriptingflask_app.py:205:12
flask.request.args reaches flask.make_response without a sanitizer for CWE-79.
┌sourceflask_app.py:204 name = request.args.get("name", "") # flask.request.args
│propagateflask_app.py:204 name = request.args.get("name", "") # .get()
│propagateflask_app.py:205 resp = make_response(f"<p>{name}</p>") # VULN:CWE-79 # f-string
└sinkflask_app.py:205 resp = make_response(f"<p>{name}</p>") # VULN:CWE-79 # flask.make_response
Fix. Render through a template with auto-escaping or escape with markupsafe.escape().
confidence high · source flask.request.args · sink flask.make_response · fp e8b9ff535e5769fa
HIGHPath traversal: tainted path servedSL-PATH-005 · A01:2021 · CWE-22 · Path Traversalflask_app.py:219:12
flask.request.args reaches flask.send_file without a sanitizer for CWE-22.
┌sourceflask_app.py:218 name = request.args["f"] # flask.request.args
│propagateflask_app.py:218 name = request.args["f"] # assigned to `name`
│propagateflask_app.py:219 return send_file("/srv/files/" + name) # VULN:CWE-22 # concat
└sinkflask_app.py:219 return send_file("/srv/files/" + name) # VULN:CWE-22 # flask.send_file
Fix. Use flask.send_from_directory(BASE, filename) which refuses escapes.
confidence high · source flask.request.args · sink flask.send_file · fp dfed526fea1add51
HIGHPath traversal: tainted path openedSL-PATH-001 · A01:2021 · CWE-22 · Path Traversalflask_app.py:237:10
flask.request.args reaches builtins.open without a sanitizer for CWE-22.
┌sourceflask_app.py:236 name = request.args["f"] # flask.request.args
│propagateflask_app.py:236 name = request.args["f"] # assigned to `name`
│propagateflask_app.py:237 with open(os.path.join("/srv/files", name)) as fh: # VULN:CWE-22 # os.path.join()
└sinkflask_app.py:237 with open(os.path.join("/srv/files", name)) as fh: # VULN:CWE-22 # builtins.open
Fix. Resolve against a base dir and reject if not under it: p = (BASE / name).resolve(); p.relative_to(BASE)
confidence high · source flask.request.args · sink builtins.open · fp 2fec8695a495bce9
HIGHPath traversal: tainted path removedSL-PATH-002 · A01:2021 · CWE-22 · Path Traversalflask_app.py:260:5
flask.request.form reaches os.remove without a sanitizer for CWE-22.
┌sourceflask_app.py:259 name = request.form["name"] # flask.request.form
│propagateflask_app.py:259 name = request.form["name"] # assigned to `name`
│propagateflask_app.py:260 os.remove("/tmp/uploads/" + name) # VULN:CWE-22 # concat
└sinkflask_app.py:260 os.remove("/tmp/uploads/" + name) # VULN:CWE-22 # os.remove
confidence high · source flask.request.form · sink os.remove · fp 735ca04af59f6b14
HIGHSSRF: tainted URL fetched server-sideSL-SSRF-001 · A10:2021 · CWE-918 · Server-Side Request Forgeryflask_app.py:317:12
flask.request.args reaches requests.get without a sanitizer for CWE-918.
┌sourceflask_app.py:317 return requests.get(request.args["url"]).text # VULN:CWE-918 # flask.request.args
└sinkflask_app.py:317 return requests.get(request.args["url"]).text # VULN:CWE-918 # requests.get
Fix. Allow-list hosts/schemes, resolve DNS and reject private ranges, disable redirects.
confidence high · source flask.request.args · sink requests.get · fp 4b68ec84b9ac9be9
HIGHSSRF: tainted URL fetched server-sideSL-SSRF-001 · A10:2021 · CWE-918 · Server-Side Request Forgeryflask_app.py:331:12
flask.request.args reaches requests.get without a sanitizer for CWE-918.
┌sourceflask_app.py:330 path = request.args["path"] # flask.request.args
│propagateflask_app.py:330 path = request.args["path"] # assigned to `path`
│propagateflask_app.py:331 return requests.get("https://api.internal/" + path).text # VULN:CWE-918 # concat
└sinkflask_app.py:331 return requests.get("https://api.internal/" + path).text # VULN:CWE-918 # requests.get
Fix. Allow-list hosts/schemes, resolve DNS and reject private ranges, disable redirects.
confidence high · source flask.request.args · sink requests.get · fp 7019bbe6c38258cc
HIGHPath traversal: tainted path servedSL-PATH-005 · A01:2021 · CWE-22 · Path Traversalhard_app.py:53:12
flask.request.args reaches flask.send_file without a sanitizer for CWE-22.
┌sourcehard_app.py:53 return send_file(box.join(request.args["f"])) # VULN:CWE-22 # flask.request.args
│callhard_app.py:53 return send_file(box.join(request.args["f"])) # VULN:CWE-22 # through PathBox.join()
└sinkhard_app.py:53 return send_file(box.join(request.args["f"])) # VULN:CWE-22 # flask.send_file
Fix. Use flask.send_from_directory(BASE, filename) which refuses escapes.
confidence high · source flask.request.args · sink flask.send_file · fp cbe6d4a068c855c2
HIGHReflected XSS: tainted string returned from viewSL-XSS-004 · A03:2021 · CWE-79 · Cross-Site Scriptinghard_app.py:170:5
flask.request.args reaches __return_http__ without a sanitizer for CWE-79.
┌sourcehard_app.py:168 name = request.args.get("n", "") # flask.request.args
│propagatehard_app.py:168 name = request.args.get("n", "") # .get()
│sanitizerhard_app.py:169 out = escape(name) if len(name) < 10 else name # markupsafe.escape: clears CWE-79
│propagatehard_app.py:169 out = escape(name) if len(name) < 10 else name # assigned to `out`
│propagatehard_app.py:170 return "<b>" + out + "</b>" # VULN:CWE-79 (one branch unescaped) # concat
└sinkhard_app.py:170 return "<b>" + out + "</b>" # VULN:CWE-79 (one branch unescaped) # __return_http__
Fix. Return a rendered template or escape the value with markupsafe.escape().
confidence high · source flask.request.args · sink __return_http__ · fp a5bf6b2f30607cec
HIGHPath traversal: tainted path servedSL-PATH-005 · A01:2021 · CWE-22 · Path Traversalsmoke_app.py:47:12
flask.request.args reaches flask.send_file without a sanitizer for CWE-22.
┌sourcesmoke_app.py:46 name = request.args.get("f") # flask.request.args
│propagatesmoke_app.py:46 name = request.args.get("f") # .get()
│propagatesmoke_app.py:47 return send_file(os.path.join("/srv", name)) # path traversal # os.path.join()
└sinksmoke_app.py:47 return send_file(os.path.join("/srv", name)) # path traversal # flask.send_file
Fix. Use flask.send_from_directory(BASE, filename) which refuses escapes.
confidence high · source flask.request.args · sink flask.send_file · fp 68b88e6cb264aec6
HIGHReflected XSS: tainted body in HTTP responseSL-XSS-003 · A03:2021 · CWE-79 · Cross-Site Scriptingsmoke_app.py:63:12
flask.request.args reaches flask.render_template_string without a sanitizer for CWE-79.
┌sourcesmoke_app.py:63 return render_template_string("<h1>Hi " + request.args.get("n") + "</h1>") # SSTI # flask.request.args
│propagatesmoke_app.py:63 return render_template_string("<h1>Hi " + request.args.get("n") + "</h1>") # SSTI # .get()
└sinksmoke_app.py:63 return render_template_string("<h1>Hi " + request.args.get("n") + "</h1>") # SSTI # flask.render_template_string
Fix. Keep the template a constant and pass user data as variables so Jinja auto-escapes it.
confidence high · source flask.request.args · sink flask.render_template_string · fp d5ae7a3ec0493c8a
HIGHReflected XSS: tainted string returned from viewSL-XSS-004 · A03:2021 · CWE-79 · Cross-Site Scriptingsmoke_app.py:67:5
flask.request.args reaches __return_http__ without a sanitizer for CWE-79.
┌sourcesmoke_app.py:67 return "<p>Hello " + request.args.get("n", "") + "</p>" # reflected XSS # flask.request.args
│propagatesmoke_app.py:67 return "<p>Hello " + request.args.get("n", "") + "</p>" # reflected XSS # .get()
└sinksmoke_app.py:67 return "<p>Hello " + request.args.get("n", "") + "</p>" # reflected XSS # __return_http__
Fix. Return a rendered template or escape the value with markupsafe.escape().
confidence high · source flask.request.args · sink __return_http__ · fp 57b2a22c435863a3
HIGHSSRF: tainted URL fetched server-sideSL-SSRF-001 · A10:2021 · CWE-918 · Server-Side Request Forgerysmoke_app.py:78:9
flask.request.args reaches requests.get without a sanitizer for CWE-918.
┌sourcesmoke_app.py:78 r = requests.get(request.args["url"]) # SSRF # flask.request.args
└sinksmoke_app.py:78 r = requests.get(request.args["url"]) # SSRF # requests.get
Fix. Allow-list hosts/schemes, resolve DNS and reject private ranges, disable redirects.
confidence high · source flask.request.args · sink requests.get · fp 5e053b496d31e672
HIGHPath traversal: tainted path openedSL-PATH-001 · A01:2021 · CWE-22 · Path Traversalsmoke_app.py:93:5
input() reaches builtins.open without a sanitizer for CWE-22.
┌sourcesmoke_app.py:92 path = input("file? ") # input()
│propagatesmoke_app.py:92 path = input("file? ") # assigned to `path`
└sinksmoke_app.py:93 open(path).read() # CLI path traversal (input source) # builtins.open
Fix. Resolve against a base dir and reject if not under it: p = (BASE / name).resolve(); p.relative_to(BASE)
confidence high · source input() · sink builtins.open · fp be655dbce2929375
MEDIUMOpen redirect: tainted redirect targetSL-REDIR-001 · A01:2021 · CWE-601 · Open Redirectfastapi_django_app.py:66:12
fastapi.Query reaches fastapi.responses.RedirectResponse without a sanitizer for CWE-601.
┌sourcefastapi_django_app.py:65 def go(url: str = Query("/")): # fastapi.Query parameter `url`
└sinkfastapi_django_app.py:66 return RedirectResponse(url) # VULN:CWE-601 # fastapi.responses.RedirectResponse
confidence high · source fastapi.Query · sink fastapi.responses.RedirectResponse · fp 788a541e175f8cb0
MEDIUMOpen redirect: tainted redirect targetSL-REDIR-001 · A01:2021 · CWE-601 · Open Redirectfastapi_django_app.py:144:12
request param.GET reaches django.http.HttpResponseRedirect without a sanitizer for CWE-601.
┌sourcefastapi_django_app.py:144 return HttpResponseRedirect(request.GET.get("next", "/")) # VULN:CWE-601 # request param.GET
│propagatefastapi_django_app.py:144 return HttpResponseRedirect(request.GET.get("next", "/")) # VULN:CWE-601 # .get()
└sinkfastapi_django_app.py:144 return HttpResponseRedirect(request.GET.get("next", "/")) # VULN:CWE-601 # django.http.HttpResponseRedirect
confidence high · source request param.GET · sink django.http.HttpResponseRedirect · fp cc1d5deed66cb4c9
MEDIUMOpen redirect: tainted redirect targetSL-REDIR-001 · A01:2021 · CWE-601 · Open Redirectflask_app.py:266:12
flask.request.args reaches flask.redirect without a sanitizer for CWE-601.
┌sourceflask_app.py:266 return redirect(request.args.get("next", "/")) # VULN:CWE-601 # flask.request.args
│propagateflask_app.py:266 return redirect(request.args.get("next", "/")) # VULN:CWE-601 # .get()
└sinkflask_app.py:266 return redirect(request.args.get("next", "/")) # VULN:CWE-601 # flask.redirect
Fix. Allow-list targets or verify urlparse(target).netloc in {'', request.host}.
confidence high · source flask.request.args · sink flask.redirect · fp c0c4571c5795aebf
MEDIUMTainted secret hashed with MD5SL-CRYPTO-001 · A02:2021 · CWE-328 · Weak Hashflask_app.py:344:12
flask.request.form reaches hashlib.md5 without a sanitizer for CWE-328.
┌sourceflask_app.py:343 pw = request.form["password"] # flask.request.form
│propagateflask_app.py:343 pw = request.form["password"] # assigned to `pw`
│propagateflask_app.py:344 return hashlib.md5(pw.encode()).hexdigest() # VULN:CWE-328 # .encode()
└sinkflask_app.py:344 return hashlib.md5(pw.encode()).hexdigest() # VULN:CWE-328 # hashlib.md5
Fix. Use hashlib.sha256 or, for passwords, argon2/bcrypt/scrypt.
confidence high · source flask.request.form · sink hashlib.md5 · fp 4463f675bd72e370
MEDIUMOpen redirect: tainted redirect targetSL-REDIR-001 · A01:2021 · CWE-601 · Open Redirecthard_app.py:277:12
flask.request.args reaches flask.redirect without a sanitizer for CWE-601.
┌sourcehard_app.py:276 nxt = request.args.get("next") # flask.request.args
│propagatehard_app.py:276 nxt = request.args.get("next") # .get()
└sinkhard_app.py:277 return redirect(nxt or "/") # VULN:CWE-601 # flask.redirect
Fix. Allow-list targets or verify urlparse(target).netloc in {'', request.host}.
confidence high · source flask.request.args · sink flask.redirect · fp 792924facc19c466
MEDIUMOpen redirect: tainted redirect targetSL-REDIR-001 · A01:2021 · CWE-601 · Open Redirectsmoke_app.py:59:12
flask.request.args reaches flask.redirect without a sanitizer for CWE-601.
┌sourcesmoke_app.py:56 nxt = request.args.get("next", "/") # flask.request.args
│propagatesmoke_app.py:56 nxt = request.args.get("next", "/") # .get()
└sinksmoke_app.py:59 return redirect(nxt) # open redirect # flask.redirect
Fix. Allow-list targets or verify urlparse(target).netloc in {'', request.host}.
confidence high · source flask.request.args · sink flask.redirect · fp 25d93eb4dcef021d
LOWLog injection: tainted data in log messageSL-LOGI-001 · A09:2021 · CWE-117 · Log Injectionfastapi_django_app.py:159:5
request param.POST reaches logging.Logger.info without a sanitizer for CWE-117.
┌sourcefastapi_django_app.py:159 log.info("login attempt for " + request.POST.get("user", "")) # VULN:CWE-117 # request param.POST
│propagatefastapi_django_app.py:159 log.info("login attempt for " + request.POST.get("user", "")) # VULN:CWE-117 # .get()
└sinkfastapi_django_app.py:159 log.info("login attempt for " + request.POST.get("user", "")) # VULN:CWE-117 # logging.Logger.info
Fix. Log with parameters (logger.info('x=%r', x)) or strip newlines; never log secrets.
confidence high · source request param.POST · sink logging.Logger.info · fp 587d1582a68e3843