updates

Backend/venv/lib/python3.12/site-packages/bandit/plugins/app_debug.py

@@ -0,0 +1,63 @@
+#
+# Copyright 2015 Hewlett-Packard Development Company, L.P.
+#
+# SPDX-License-Identifier: Apache-2.0
+r"""
+======================================================
+B201: Test for use of flask app with debug set to true
+======================================================
+
+Running Flask applications in debug mode results in the Werkzeug debugger
+being enabled. This includes a feature that allows arbitrary code execution.
+Documentation for both Flask [1]_ and Werkzeug [2]_ strongly suggests that
+debug mode should never be enabled on production systems.
+
+Operating a production server with debug mode enabled was the probable cause
+of the Patreon breach in 2015 [3]_.
+
+:Example:
+
+.. code-block:: none
+
+    >> Issue: A Flask app appears to be run with debug=True, which exposes
+    the Werkzeug debugger and allows the execution of arbitrary code.
+       Severity: High   Confidence: High
+       CWE: CWE-94 (https://cwe.mitre.org/data/definitions/94.html)
+       Location: examples/flask_debug.py:10
+    9 #bad
+    10    app.run(debug=True)
+    11
+
+.. seealso::
+
+ .. [1] https://flask.palletsprojects.com/en/1.1.x/quickstart/#debug-mode
+ .. [2] https://werkzeug.palletsprojects.com/en/1.0.x/debug/
+ .. [3] https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/
+ .. https://cwe.mitre.org/data/definitions/94.html
+
+.. versionadded:: 0.15.0
+
+.. versionchanged:: 1.7.3
+    CWE information added
+
+"""  # noqa: E501
+import bandit
+from bandit.core import issue
+from bandit.core import test_properties as test
+
+
+@test.test_id("B201")
+@test.checks("Call")
+def flask_debug_true(context):
+    if context.is_module_imported_like("flask"):
+        if context.call_function_name_qual.endswith(".run"):
+            if context.check_call_arg_value("debug", "True"):
+                return bandit.Issue(
+                    severity=bandit.HIGH,
+                    confidence=bandit.MEDIUM,
+                    cwe=issue.Cwe.CODE_INJECTION,
+                    text="A Flask app appears to be run with debug=True, "
+                    "which exposes the Werkzeug debugger and allows "
+                    "the execution of arbitrary code.",
+                    lineno=context.get_lineno_for_call_arg("debug"),
+                )