Modify rule S3330: Add FastAPI (APPSEC-1260) (#3392)

## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
This commit is contained in:
Egon Okerman 2023-11-06 09:56:54 +01:00 committed by GitHub
parent 2c7f43c449
commit 6429a96b02
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -6,33 +6,64 @@ include::../recommended.adoc[]
== Sensitive Code Example
Flask:
Using Flask:
[source,python,diff-id=11,diff-type=noncompliant]
----
from flask import Response
@app.route('/')
def index():
response = Response()
response.set_cookie('key', 'value') # Sensitive
response.set_cookie('key', 'value') # Sensitive
return response
----
Using FastAPI:
[source,python,diff-id=21,diff-type=noncompliant]
----
from fastapi import FastAPI, Response
app = FastAPI()
@app.get('/')
async def index(response: Response):
response.set_cookie('key', 'value') # Sensitive
return {"message": "Hello world!"}
----
== Compliant Solution
Flask:
Using Flask:
[source,python]
[source,python,diff-id=11,diff-type=compliant]
----
from flask import Response
@app.route('/')
def index():
response = Response()
response.set_cookie('key', 'value', httponly=True) # Compliant
response.set_cookie('key', 'value', httponly=True)
return response
----
Using FastAPI:
[source,python,diff-id=21,diff-type=compliant]
----
from fastapi import FastAPI, Response
app = FastAPI()
@app.get('/')
async def index(response: Response):
response.set_cookie('key', 'value', httponly=True)
return {"message": "Hello world!"}
----
include::../see.adoc[]
ifdef::env-github,rspecator-view[]