Modify rule S5144: Add aiohttp support (APPSEC-1248) (#3373)

## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>
This commit is contained in:
daniel-teuchert-sonarsource 2023-10-27 16:57:53 +02:00 committed by GitHub
parent 0985aec222
commit 32a9027c5b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 54 additions and 0 deletions

View File

@ -78,6 +78,7 @@
* Django
* Django Templates
* Flask
* aiohttp
* Jinja
* lxml
* Paramiko

View File

@ -0,0 +1,50 @@
== How to fix it in aiohttp
=== Code examples
include::../../common/fix/code-rationale.adoc[]
==== Noncompliant code example
[source,python,diff-id=31,diff-type=noncompliant]
----
from fastapi import FastAPI
import aiohttp
app = FastAPI()
@app.get('/example')
async def example(url: str):
async with aiohttp.request('GET', url) as response: # Noncompliant
return {"response": await response.text()}
----
==== Compliant solution
[source,python,diff-id=31,diff-type=compliant]
----
from fastapi import FastAPI
from fastapi.responses import JSONResponse
import aiohttp
from urllib.parse import urlparse
DOMAINS_ALLOWLIST = ['trusted1.example.com', 'trusted2.example.com'];
app = FastAPI()
@app.get('/example')
async def example(url: str):
if urlparse(url).hostname not in DOMAINS_ALLOWLIST:
return JSONResponse({"error": f"URL {url} is not whitelisted."}, 400)
async with aiohttp.request('GET', url.unicode_string()) as response:
return {"response": await response.text()}
----
=== How does this work?
include::../../common/fix/pre-approved-list.adoc[]
The compliant code example uses such an approach.
=== Pitfalls
include::../../common/pitfalls/starts-with.adoc[]

View File

@ -12,6 +12,9 @@ include::how-to-fix-it/requests.adoc[]
include::how-to-fix-it/httpx.adoc[]
include::how-to-fix-it/aiohttp.adoc[]
== Resources
include::../common/resources/standards.adoc[]