Files
codeql/python/ql/test/library-tests/frameworks/flask/file_sending.py
Rasmus Wriedt Larsen 8c3349f40f Python: Properly model flask.send_from_directory
To not include `filename` as path-injection sink.
2021-10-28 13:41:39 +02:00

8 lines
352 B
Python

from flask import send_from_directory, send_file
send_from_directory("dir", "file") # $ getAPathArgument="dir" getAPathArgument="file"
send_from_directory(directory="dir", filename="file") # $ getAPathArgument="dir" getAPathArgument="file"
send_file("file") # $ getAPathArgument="file"
send_file(filename_or_fp="file") # $ getAPathArgument="file"