hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-18 05:24:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Model FastAPI FileResponse as FileSystemAccess

Browse Source 
This was an oversight from our initial FastAPI modeling work.
This commit is contained in:
Rasmus Wriedt Larsen
2021-11-24 11:31:59 +01:00
parent 8c9e817c0d
commit d493cfdf3a
3 changed files with 19 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
python/change-notes/2021-11-24-FastAPI-FileResponse-FileSystemAccess copy.md Normal file
View File

@@ -0,0 +1,2 @@
lgtm,codescanning
* Extended the modeling of FastAPI such that `fastapi.responses.FileResponse` are considered `FileSystemAccess`, making them sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.