64 lines
2.2 KiB
Python
64 lines
2.2 KiB
Python
#
|
|
# Copyright 2015 Hewlett-Packard Development Company, L.P.
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
r"""
|
|
======================================================
|
|
B201: Test for use of flask app with debug set to true
|
|
======================================================
|
|
|
|
Running Flask applications in debug mode results in the Werkzeug debugger
|
|
being enabled. This includes a feature that allows arbitrary code execution.
|
|
Documentation for both Flask [1]_ and Werkzeug [2]_ strongly suggests that
|
|
debug mode should never be enabled on production systems.
|
|
|
|
Operating a production server with debug mode enabled was the probable cause
|
|
of the Patreon breach in 2015 [3]_.
|
|
|
|
:Example:
|
|
|
|
.. code-block:: none
|
|
|
|
>> Issue: A Flask app appears to be run with debug=True, which exposes
|
|
the Werkzeug debugger and allows the execution of arbitrary code.
|
|
Severity: High Confidence: High
|
|
CWE: CWE-94 (https://cwe.mitre.org/data/definitions/94.html)
|
|
Location: examples/flask_debug.py:10
|
|
9 #bad
|
|
10 app.run(debug=True)
|
|
11
|
|
|
|
.. seealso::
|
|
|
|
.. [1] https://flask.palletsprojects.com/en/1.1.x/quickstart/#debug-mode
|
|
.. [2] https://werkzeug.palletsprojects.com/en/1.0.x/debug/
|
|
.. [3] https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/
|
|
.. https://cwe.mitre.org/data/definitions/94.html
|
|
|
|
.. versionadded:: 0.15.0
|
|
|
|
.. versionchanged:: 1.7.3
|
|
CWE information added
|
|
|
|
""" # noqa: E501
|
|
import bandit
|
|
from bandit.core import issue
|
|
from bandit.core import test_properties as test
|
|
|
|
|
|
@test.test_id("B201")
|
|
@test.checks("Call")
|
|
def flask_debug_true(context):
|
|
if context.is_module_imported_like("flask"):
|
|
if context.call_function_name_qual.endswith(".run"):
|
|
if context.check_call_arg_value("debug", "True"):
|
|
return bandit.Issue(
|
|
severity=bandit.HIGH,
|
|
confidence=bandit.MEDIUM,
|
|
cwe=issue.Cwe.CODE_INJECTION,
|
|
text="A Flask app appears to be run with debug=True, "
|
|
"which exposes the Werkzeug debugger and allows "
|
|
"the execution of arbitrary code.",
|
|
lineno=context.get_lineno_for_call_arg("debug"),
|
|
)
|