Conversation
![pixeebot[bot]](https://avatars.githubusercontent.com/in/193111?s=60&v=4){kind=small}
| re | ||
| surrealdb | ||
| aiohttp | ||
| security==1.3.1 |
There was a problem hiding this comment.
This library holds security tools for protecting Python API calls.
License: MIT ✅ Open Source ✅ More facts
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Join our Discord community for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @api.get("/assets/{asset}", description="Get an asset.") | ||
| def get_asset(asset: str, width: int = None, height: int = None): | ||
| if not width and not height: | ||
| try: |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 months ago
To fix the issue, we need to validate the asset parameter to ensure it does not allow directory traversal or access to files outside the intended directory. The best approach is to:
- Normalize the constructed path using
os.path.normpathorpathlib.Path.resolve()to eliminate any..segments. - Verify that the normalized path is within the intended base directory.
- Reject the request if the validation fails.
Additionally, we can use a whitelist of allowed filenames if the set of valid assets is known and limited.
| @@ -89,7 +89,11 @@ | ||
| def get_asset(asset: str, width: int = None, height: int = None): | ||
| if not width and not height: | ||
| try: | ||
| return fastapi.responses.FileResponse(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/{asset}") | ||
| except: | ||
| return fastapi.responses.JSONResponse(status_code=404, content={"message": "This asset does not exist."}) | ||
| base_path = pathlib.Path(__file__).parent.parent.resolve() / "assets" | ||
| try: | ||
| # Normalize the path and ensure it is within the base directory | ||
| asset_path = (base_path / asset).resolve() | ||
| if not str(asset_path).startswith(str(base_path)): | ||
| raise ValueError("Invalid asset path") | ||
| return fastapi.responses.FileResponse(asset_path) | ||
| except (FileNotFoundError, ValueError): | ||
| return fastapi.responses.JSONResponse(status_code=404, content={"message": "This asset does not exist."}) | ||
| else: |
| if asset == "logo_no_bg": | ||
| image = Image.open(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/Astroid Logo no bg.png") | ||
| new_image = image.resize((width, height)) | ||
| new_image.save(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid Logo no bg.png") |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 months ago
To fix the issue, we need to validate the width parameter before using it in constructing file paths. The best approach is to ensure that width is a positive integer and falls within a reasonable range. Additionally, we should normalize the constructed file path using os.path.normpath and verify that it remains within the intended directory.
Steps to implement the fix:
- Validate the
widthparameter to ensure it is a positive integer within a safe range. - Normalize the constructed file path using
os.path.normpath. - Check that the normalized path starts with the intended base directory to prevent path traversal attacks.
| @@ -98,4 +98,9 @@ | ||
| new_image = image.resize((width, height)) | ||
| new_image.save(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid Logo no bg.png") | ||
| return fastapi.responses.FileResponse(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid Logo no bg{width}x{height}.png") | ||
| base_path = pathlib.Path(__file__).parent.parent.resolve() / "assets/resized" | ||
| safe_filename = f"Astroid Logo no bg{width}x{height}.png" | ||
| full_path = os.path.normpath(base_path / safe_filename) | ||
| if not str(full_path).startswith(str(base_path)): | ||
| return fastapi.responses.JSONResponse(status_code=400, content={"message": "Invalid file path."}) | ||
| new_image.save(full_path) | ||
| return fastapi.responses.FileResponse(full_path) | ||
| elif asset == "logo": | ||
| @@ -103,4 +108,9 @@ | ||
| new_image = image.resize((width, height)) | ||
| new_image.save(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid Logo.png") | ||
| return fastapi.responses.FileResponse(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid Logo{width}x{height}.png") | ||
| base_path = pathlib.Path(__file__).parent.parent.resolve() / "assets/resized" | ||
| safe_filename = f"Astroid Logo{width}x{height}.png" | ||
| full_path = os.path.normpath(base_path / safe_filename) | ||
| if not str(full_path).startswith(str(base_path)): | ||
| return fastapi.responses.JSONResponse(status_code=400, content={"message": "Invalid file path."}) | ||
| new_image.save(full_path) | ||
| return fastapi.responses.FileResponse(full_path) | ||
| elif asset == "banner": | ||
| @@ -108,4 +118,9 @@ | ||
| new_image = image.resize((width, height)) | ||
| new_image.save(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid-banner.png") | ||
| return fastapi.responses.FileResponse(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid-banner{width}x{height}.png") | ||
| base_path = pathlib.Path(__file__).parent.parent.resolve() / "assets/resized" | ||
| safe_filename = f"Astroid-banner{width}x{height}.png" | ||
| full_path = os.path.normpath(base_path / safe_filename) | ||
| if not str(full_path).startswith(str(base_path)): | ||
| return fastapi.responses.JSONResponse(status_code=400, content={"message": "Invalid file path."}) | ||
| new_image.save(full_path) | ||
| return fastapi.responses.FileResponse(full_path) | ||
| else: |
| elif asset == "logo": | ||
| image = Image.open(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/Astroid Logo.png") | ||
| new_image = image.resize((width, height)) | ||
| new_image.save(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid Logo.png") |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 months ago
To fix the issue, we need to validate and sanitize the user-controlled width and height parameters before using them in file path construction. Additionally, we should ensure that the constructed file paths are contained within a safe root directory. This can be achieved by normalizing the path using os.path.normpath and verifying that it starts with the intended base directory.
Steps to implement the fix:
- Validate
widthandheightto ensure they are positive integers. - Construct the file path using
os.path.joinand normalize it usingos.path.normpath. - Verify that the normalized path starts with the intended base directory.
- Use a safe mechanism to sanitize file names, such as
werkzeug.utils.secure_filename, if applicable.
| @@ -98,4 +98,9 @@ | ||
| new_image = image.resize((width, height)) | ||
| new_image.save(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid Logo no bg.png") | ||
| return fastapi.responses.FileResponse(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid Logo no bg{width}x{height}.png") | ||
| base_path = pathlib.Path(__file__).parent.parent.resolve() / "assets/resized" | ||
| safe_filename = f"Astroid Logo no bg{width}x{height}.png" | ||
| full_path = os.path.normpath(base_path / safe_filename) | ||
| if not str(full_path).startswith(str(base_path)): | ||
| return fastapi.responses.JSONResponse(status_code=400, content={"message": "Invalid file path."}) | ||
| new_image.save(full_path) | ||
| return fastapi.responses.FileResponse(full_path) | ||
| elif asset == "logo": | ||
| @@ -103,4 +108,9 @@ | ||
| new_image = image.resize((width, height)) | ||
| new_image.save(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid Logo.png") | ||
| return fastapi.responses.FileResponse(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid Logo{width}x{height}.png") | ||
| base_path = pathlib.Path(__file__).parent.parent.resolve() / "assets/resized" | ||
| safe_filename = f"Astroid Logo{width}x{height}.png" | ||
| full_path = os.path.normpath(base_path / safe_filename) | ||
| if not str(full_path).startswith(str(base_path)): | ||
| return fastapi.responses.JSONResponse(status_code=400, content={"message": "Invalid file path."}) | ||
| new_image.save(full_path) | ||
| return fastapi.responses.FileResponse(full_path) | ||
| elif asset == "banner": | ||
| @@ -108,4 +118,9 @@ | ||
| new_image = image.resize((width, height)) | ||
| new_image.save(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid-banner.png") | ||
| return fastapi.responses.FileResponse(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid-banner{width}x{height}.png") | ||
| base_path = pathlib.Path(__file__).parent.parent.resolve() / "assets/resized" | ||
| safe_filename = f"Astroid-banner{width}x{height}.png" | ||
| full_path = os.path.normpath(base_path / safe_filename) | ||
| if not str(full_path).startswith(str(base_path)): | ||
| return fastapi.responses.JSONResponse(status_code=400, content={"message": "Invalid file path."}) | ||
| new_image.save(full_path) | ||
| return fastapi.responses.FileResponse(full_path) | ||
| else: |
| elif asset == "banner": | ||
| image = Image.open(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid-banner.png") | ||
| new_image = image.resize((width, height)) | ||
| new_image.save(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid-banner.png") |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 months ago
To fix the issue, we need to validate and sanitize the width parameter before using it in file path construction. Specifically:
- Ensure that
widthis a positive integer and falls within a reasonable range to prevent abuse (e.g., excessively large values). - Use a safe and normalized base directory for all file operations to prevent path traversal attacks.
- Construct file paths using
os.path.joinorpathlibto ensure proper handling of directory separators and avoid concatenating untrusted data directly into file paths.
The fix will involve:
- Adding validation logic for the
widthparameter. - Ensuring that all file paths are constructed safely and checked against a predefined base directory.
| @@ -89,5 +89,17 @@ | ||
| def get_asset(asset: str, width: int = None, height: int = None): | ||
| base_path = pathlib.Path(__file__).parent.parent.resolve() / "assets" | ||
| resized_path = base_path / "resized" | ||
|
|
||
| # Validate width and height | ||
| if width is not None and (not isinstance(width, int) or width <= 0 or width > 5000): | ||
| return fastapi.responses.JSONResponse(status_code=400, content={"message": "Invalid width parameter."}) | ||
| if height is not None and (not isinstance(height, int) or height <= 0 or height > 5000): | ||
| return fastapi.responses.JSONResponse(status_code=400, content={"message": "Invalid height parameter."}) | ||
|
|
||
| if not width and not height: | ||
| try: | ||
| return fastapi.responses.FileResponse(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/{asset}") | ||
| asset_path = base_path / asset | ||
| if not asset_path.is_file() or not asset_path.resolve().parent == base_path: | ||
| raise FileNotFoundError | ||
| return fastapi.responses.FileResponse(str(asset_path)) | ||
| except: | ||
| @@ -95,19 +107,19 @@ | ||
| else: | ||
| if asset == "logo_no_bg": | ||
| image = Image.open(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/Astroid Logo no bg.png") | ||
| new_image = image.resize((width, height)) | ||
| new_image.save(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid Logo no bg.png") | ||
| return fastapi.responses.FileResponse(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid Logo no bg{width}x{height}.png") | ||
| elif asset == "logo": | ||
| image = Image.open(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/Astroid Logo.png") | ||
| new_image = image.resize((width, height)) | ||
| new_image.save(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid Logo.png") | ||
| return fastapi.responses.FileResponse(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid Logo{width}x{height}.png") | ||
| elif asset == "banner": | ||
| image = Image.open(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid-banner.png") | ||
| try: | ||
| if asset == "logo_no_bg": | ||
| image = Image.open(base_path / "Astroid Logo no bg.png") | ||
| elif asset == "logo": | ||
| image = Image.open(base_path / "Astroid Logo.png") | ||
| elif asset == "banner": | ||
| image = Image.open(base_path / "Astroid-banner.png") | ||
| else: | ||
| return fastapi.responses.JSONResponse(status_code=404, content={"message": "This asset does not exist."}) | ||
|
|
||
| new_image = image.resize((width, height)) | ||
| new_image.save(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid-banner.png") | ||
| return fastapi.responses.FileResponse(f"{pathlib.Path(__file__).parent.parent.resolve()}/assets/resized/Astroid-banner{width}x{height}.png") | ||
| else: | ||
| return fastapi.responses.JSONResponse(status_code=404, content={"message": "This asset does not exist."}) | ||
| resized_file = resized_path / f"{asset}{width}x{height}.png" | ||
| resized_file.parent.mkdir(parents=True, exist_ok=True) | ||
| new_image.save(resized_file) | ||
| return fastapi.responses.FileResponse(str(resized_file)) | ||
| except: | ||
| return fastapi.responses.JSONResponse(status_code=500, content={"message": "Error processing the image."}) | ||
|
|
| async def get_cdn_asset(assetId: str): | ||
| asset = await astroidapi.surrealdb_handler.AttachmentProcessor.get_attachment(assetId) | ||
| try: | ||
| if asset: |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 months ago
To fix the issue, the file path must be validated to ensure that it remains within the intended directory (astroidapi/TMP_attachments). This can be achieved by normalizing the path using os.path.normpath and verifying that the resulting path starts with the expected base directory. This approach prevents path traversal attacks by ensuring that the constructed path cannot escape the intended directory.
Steps to implement the fix:
- Normalize the constructed file path using
os.path.normpath. - Check that the normalized path starts with the base directory (
astroidapi/TMP_attachments). - Raise an exception or return an error response if the validation fails.
| @@ -165,3 +165,8 @@ | ||
| if asset: | ||
| return fastapi.responses.FileResponse(f"{pathlib.Path(__file__).parent.resolve()}/astroidapi/TMP_attachments/{assetId}.{asset['type']}") | ||
| base_path = pathlib.Path(__file__).parent.resolve() / "astroidapi/TMP_attachments" | ||
| full_path = base_path / f"{assetId}.{asset['type']}" | ||
| normalized_path = full_path.resolve() | ||
| if not str(normalized_path).startswith(str(base_path)): | ||
| return fastapi.responses.JSONResponse(status_code=400, content={"message": "Invalid asset path."}) | ||
| return fastapi.responses.FileResponse(str(normalized_path)) | ||
| else: |
| except astroidapi.errors.HealtCheckError.EndpointCheckError as e: | ||
| return fastapi.responses.JSONResponse(status_code=200, content={"message": f"An error occurred: {e}", |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 months ago
To fix the issue, the code should avoid exposing exception details (e) directly to the user. Instead, a generic error message should be returned to the user, while the detailed stack trace and exception information should be logged securely for debugging purposes. This ensures that sensitive information is not exposed externally while still allowing developers to diagnose issues.
Steps to implement the fix:
- Replace the user-facing error message with a generic message like
"An internal error has occurred.". - Log the exception details and stack trace using the
loggingmodule for internal debugging. - Ensure that the logging configuration is set up to store logs securely.
| @@ -486,3 +486,4 @@ | ||
| except astroidapi.errors.HealtCheckError.EndpointCheckError as e: | ||
| return fastapi.responses.JSONResponse(status_code=200, content={"message": f"An error occurred: {e}", | ||
| logging.exception("An unexpected error occurred during endpoint health check.") | ||
| return fastapi.responses.JSONResponse(status_code=200, content={"message": "An internal error has occurred.", | ||
| "details": "unexpectederror"}) | ||
| @@ -492,4 +493,4 @@ | ||
| except astroidapi.errors.SurrealDBHandler.GetEndpointError as e: | ||
| traceback.print_exc() | ||
| return fastapi.responses.JSONResponse(status_code=404, content={"message": f"An error occurred: {e}", | ||
| logging.exception("An error occurred while retrieving endpoint information.") | ||
| return fastapi.responses.JSONResponse(status_code=404, content={"message": "An internal error has occurred.", | ||
| "details": "getendpointerror"}) |
| traceback.print_exc() | ||
| return fastapi.responses.JSONResponse(status_code=404, content={"message": f"An error occurred: {e}", |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 months ago
To fix the issue, the code should be updated to prevent sensitive information from being exposed in the response. Instead of including the exception details (e) in the response, log the full stack trace internally using the logging module and return a generic error message to the user. This ensures that developers can still access detailed error information for debugging purposes while protecting the application from information exposure.
The changes will involve:
- Replacing
traceback.print_exc()withlogging.exception()to log the stack trace internally. - Modifying the response message to exclude the exception details and use a generic error message instead.
| @@ -492,4 +492,4 @@ | ||
| except astroidapi.errors.SurrealDBHandler.GetEndpointError as e: | ||
| traceback.print_exc() | ||
| return fastapi.responses.JSONResponse(status_code=404, content={"message": f"An error occurred: {e}", | ||
| logging.exception("An error occurred while handling GetEndpointError.") | ||
| return fastapi.responses.JSONResponse(status_code=404, content={"message": "An error occurred while processing the request.", | ||
| "details": "getendpointerror"}) |
| summary = await astroidapi.health_check.HealthCheck.EndpointCheck.repair_structure(endpoint) | ||
| return fastapi.responses.JSONResponse(status_code=200, content={"message": "Repaired.", "summary": summary}) | ||
| except Exception as e: | ||
| logging.exception(traceback.print_exc()) |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 months ago
To fix the issue, the code should avoid including the exception details (e) in the response message sent to the user. Instead, a generic error message should be returned to the user, while the detailed exception information, including the stack trace, should be logged securely for debugging purposes. This ensures that sensitive information is not exposed externally while still allowing developers to diagnose issues.
The changes involve:
- Replacing the response message that includes
ewith a generic error message. - Logging the exception details using the
loggingmodule for internal use.
| @@ -508,4 +508,4 @@ | ||
| except Exception as e: | ||
| logging.exception(traceback.print_exc()) | ||
| return fastapi.responses.JSONResponse(status_code=500, content={"message": f"An error occurred: {e}"}) | ||
| logging.exception("An error occurred while repairing the endpoint.", exc_info=e) | ||
| return fastapi.responses.JSONResponse(status_code=500, content={"message": "An internal error has occurred. Please contact support if the issue persists."}) | ||
| else: |
| return fastapi.responses.JSONResponse(status_code=401, content={"message": "You must provide a token."}) | ||
| except KeyError: | ||
| if token == Bot.config.MASTER_TOKEN: | ||
| try: |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 months ago
To fix the issue, we need to validate the endpoint parameter before using it to construct a file path. The best approach is to ensure that the constructed path is contained within a safe root directory. This can be achieved by normalizing the path using os.path.normpath and verifying that the resulting path starts with the intended base directory.
Steps to implement the fix:
- Define a safe root directory for the
endpointsfolder. - Normalize the constructed path using
os.path.normpath. - Check that the normalized path starts with the safe root directory.
- Raise an exception or return an error response if the validation fails.
| @@ -597,3 +597,8 @@ | ||
| try: | ||
| os.remove(f"{pathlib.Path(__file__).parent.resolve()}/endpoints/{endpoint}.json") | ||
| base_path = pathlib.Path(__file__).parent.resolve() / "endpoints" | ||
| target_path = base_path / f"{endpoint}.json" | ||
| normalized_path = target_path.resolve() | ||
| if not str(normalized_path).startswith(str(base_path)): | ||
| raise HTTPException(status_code=403, detail="Invalid endpoint path.") | ||
| os.remove(normalized_path) | ||
| return fastapi.responses.JSONResponse(status_code=200, content={"message": "Deleted."}) |
| try: | ||
| await astroidapi.surrealdb_handler.sync_server_relations() | ||
| return fastapi.responses.JSONResponse(status_code=200, content={"message": "Success."}) | ||
| except Exception as e: |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 months ago
To fix the issue, we need to ensure that sensitive information contained in the exception object e is not exposed to the client. Instead, we should log the detailed error message on the server for debugging purposes and return a generic error message to the client. This approach aligns with the best practices for handling exceptions securely.
- Replace the line that includes
{"message": f"An error occurred: {e}"}with a generic error message like{"message": "An internal error occurred."}. - Log the exception details (e.g., stack trace) on the server using the
loggingmodule to ensure developers can still debug the issue.
| @@ -757,3 +757,4 @@ | ||
| except Exception as e: | ||
| return fastapi.responses.JSONResponse(status_code=500, content={"message": f"An error occurred: {e}"}) | ||
| logging.error("An error occurred while syncing server relations.", exc_info=True) | ||
| return fastapi.responses.JSONResponse(status_code=500, content={"message": "An internal error occurred."}) | ||
|
|
|
I'm confident in this change, but I'm not a maintainer of this project. Do you see any reason not to merge it? If this change was not helpful, or you have suggestions for improvements, please let me know! |
|
Just a friendly ping to remind you about this change. If there are concerns about it, we'd love to hear about them! |
|
This change may not be a priority right now, so I'll close it. If there was something I could have done better, please let me know! You can also customize me to make sure I'm working with you in the way you want. |
This codemod sandboxes calls to
requests.getto be more resistant to Server-Side Request Forgery (SSRF) attacks.Most of the time when you make a
GETrequest to a URL, you're intending to reference an HTTP endpoint, like an internal microservice. However, URLs can point to local file system files, a Gopher stream in your local network, a JAR file on a remote Internet site, and all kinds of other unexpected and undesirable outcomes. When the URL values are influenced by attackers, they can trick your application into fetching internal resources, running malicious code, or otherwise harming the system.Consider the following code for a Flask app:
In this case, an attacker could supply a value like
"http://169.254.169.254/user-data/"and attempt to access user information.Our changes introduce sandboxing around URL creation that force developers to specify some boundaries on the types of URLs they expect to create:
This change alone reduces attack surface significantly because the default behavior of
safe_requests.getraises aSecurityExceptionifa user attempts to access a known infrastructure location, unless specifically disabled.
If you have feedback on this codemod, please let us know!
F.A.Q.
Why does this codemod require a Pixee dependency?
We always prefer to use built-in Python functions or one from a well-known and trusted community dependency. However, we cannot find any such control. If you know of one, please let us know.
Why is this codemod marked as Merge After Cursory Review?
By default, the protection only weaves in 2 checks, which we believe will not cause any issues with the vast majority of code:
However, on rare occasions an application may use a URL protocol like "file://" or "ftp://" in backend or middleware code.
If you want to allow those protocols, change the incoming PR to look more like this and get the best security possible:
Dependency Updates
This codemod relies on an external dependency. We have automatically added this dependency to your project's
requirements.txtfile.This library holds security tools for protecting Python API calls.
There are a number of places where Python project dependencies can be expressed, including
setup.py,pyproject.toml,setup.cfg, andrequirements.txtfiles. If this change is incorrect, or if you are using another packaging system such aspoetry, it may be necessary for you to manually add the dependency to the proper location in your project.More reading
🧚🤖 Powered by Pixeebot
Feedback | Community | Docs | Codemod ID: pixee:python/url-sandbox