Modify rule S5144: Add aiohttp support (APPSEC-1248) (#3373)
## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule) --------- Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>
This commit is contained in:
parent
0985aec222
commit
32a9027c5b
@ -78,6 +78,7 @@
|
||||
* Django
|
||||
* Django Templates
|
||||
* Flask
|
||||
* aiohttp
|
||||
* Jinja
|
||||
* lxml
|
||||
* Paramiko
|
||||
|
50
rules/S5144/python/how-to-fix-it/aiohttp.adoc
Normal file
50
rules/S5144/python/how-to-fix-it/aiohttp.adoc
Normal file
@ -0,0 +1,50 @@
|
||||
== How to fix it in aiohttp
|
||||
|
||||
=== Code examples
|
||||
|
||||
include::../../common/fix/code-rationale.adoc[]
|
||||
|
||||
==== Noncompliant code example
|
||||
|
||||
[source,python,diff-id=31,diff-type=noncompliant]
|
||||
----
|
||||
from fastapi import FastAPI
|
||||
import aiohttp
|
||||
|
||||
app = FastAPI()
|
||||
@app.get('/example')
|
||||
async def example(url: str):
|
||||
async with aiohttp.request('GET', url) as response: # Noncompliant
|
||||
return {"response": await response.text()}
|
||||
----
|
||||
|
||||
==== Compliant solution
|
||||
|
||||
[source,python,diff-id=31,diff-type=compliant]
|
||||
----
|
||||
from fastapi import FastAPI
|
||||
from fastapi.responses import JSONResponse
|
||||
import aiohttp
|
||||
from urllib.parse import urlparse
|
||||
|
||||
DOMAINS_ALLOWLIST = ['trusted1.example.com', 'trusted2.example.com'];
|
||||
app = FastAPI()
|
||||
|
||||
@app.get('/example')
|
||||
async def example(url: str):
|
||||
if urlparse(url).hostname not in DOMAINS_ALLOWLIST:
|
||||
return JSONResponse({"error": f"URL {url} is not whitelisted."}, 400)
|
||||
|
||||
async with aiohttp.request('GET', url.unicode_string()) as response:
|
||||
return {"response": await response.text()}
|
||||
----
|
||||
|
||||
=== How does this work?
|
||||
|
||||
include::../../common/fix/pre-approved-list.adoc[]
|
||||
|
||||
The compliant code example uses such an approach.
|
||||
|
||||
=== Pitfalls
|
||||
|
||||
include::../../common/pitfalls/starts-with.adoc[]
|
@ -12,6 +12,9 @@ include::how-to-fix-it/requests.adoc[]
|
||||
|
||||
include::how-to-fix-it/httpx.adoc[]
|
||||
|
||||
include::how-to-fix-it/aiohttp.adoc[]
|
||||
|
||||
|
||||
== Resources
|
||||
|
||||
include::../common/resources/standards.adoc[]
|
||||
|
Loading…
x
Reference in New Issue
Block a user