Modify rule S3330: Add FastAPI (APPSEC-1260) (#3392)
## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
This commit is contained in:
parent
2c7f43c449
commit
6429a96b02
@ -6,8 +6,9 @@ include::../recommended.adoc[]
|
|||||||
|
|
||||||
== Sensitive Code Example
|
== Sensitive Code Example
|
||||||
|
|
||||||
Flask:
|
Using Flask:
|
||||||
|
|
||||||
|
[source,python,diff-id=11,diff-type=noncompliant]
|
||||||
----
|
----
|
||||||
from flask import Response
|
from flask import Response
|
||||||
|
|
||||||
@ -18,21 +19,51 @@ def index():
|
|||||||
return response
|
return response
|
||||||
----
|
----
|
||||||
|
|
||||||
|
Using FastAPI:
|
||||||
|
|
||||||
|
[source,python,diff-id=21,diff-type=noncompliant]
|
||||||
|
----
|
||||||
|
from fastapi import FastAPI, Response
|
||||||
|
|
||||||
|
app = FastAPI()
|
||||||
|
|
||||||
|
@app.get('/')
|
||||||
|
async def index(response: Response):
|
||||||
|
response.set_cookie('key', 'value') # Sensitive
|
||||||
|
return {"message": "Hello world!"}
|
||||||
|
----
|
||||||
|
|
||||||
|
|
||||||
== Compliant Solution
|
== Compliant Solution
|
||||||
|
|
||||||
Flask:
|
Using Flask:
|
||||||
|
|
||||||
[source,python]
|
[source,python,diff-id=11,diff-type=compliant]
|
||||||
----
|
----
|
||||||
from flask import Response
|
from flask import Response
|
||||||
|
|
||||||
@app.route('/')
|
@app.route('/')
|
||||||
def index():
|
def index():
|
||||||
response = Response()
|
response = Response()
|
||||||
response.set_cookie('key', 'value', httponly=True) # Compliant
|
response.set_cookie('key', 'value', httponly=True)
|
||||||
return response
|
return response
|
||||||
----
|
----
|
||||||
|
|
||||||
|
Using FastAPI:
|
||||||
|
|
||||||
|
[source,python,diff-id=21,diff-type=compliant]
|
||||||
|
----
|
||||||
|
from fastapi import FastAPI, Response
|
||||||
|
|
||||||
|
app = FastAPI()
|
||||||
|
|
||||||
|
@app.get('/')
|
||||||
|
async def index(response: Response):
|
||||||
|
response.set_cookie('key', 'value', httponly=True)
|
||||||
|
return {"message": "Hello world!"}
|
||||||
|
----
|
||||||
|
|
||||||
|
|
||||||
include::../see.adoc[]
|
include::../see.adoc[]
|
||||||
|
|
||||||
ifdef::env-github,rspecator-view[]
|
ifdef::env-github,rspecator-view[]
|
||||||
|
Loading…
x
Reference in New Issue
Block a user