Modify rule S2092: Add FastAPI (APPSEC-1260) (#3413)

* Fix Flask docs

* Add FastAPI example
This commit is contained in:
Egon Okerman 2025-03-18 10:59:43 +01:00 committed by GitHub
parent 1dc3769b22
commit 734c90357c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -6,33 +6,64 @@ include::../recommended.adoc[]
== Sensitive Code Example
Flask
Using Flask:
[source,python,diff-id=11,diff-type=noncompliant]
----
from flask import Response
@app.route('/')
def index():
response = Response()
response.set_cookie('key', 'value') # Sensitive
response.set_cookie('key', 'value') # Sensitive
return response
----
Using FastAPI:
[source,python,diff-id=21,diff-type=noncompliant]
----
from fastapi import FastAPI, Response
app = FastAPI()
@app.get('/')
async def index(response: Response):
response.set_cookie('key', 'value') # Sensitive
return {"message": "Hello world!"}
----
== Compliant Solution
Flask
Using Flask:
[source,python]
[source,python,diff-id=11,diff-type=compliant]
----
from flask import Response
@app.route('/')
def index():
response = Response()
response.set_cookie('key', 'value', secure=True) # Compliant
response.set_cookie('key', 'value', secure=True)
return response
----
Using FastAPI:
[source,python,diff-id=21,diff-type=compliant]
----
from fastapi import FastAPI, Response
app = FastAPI()
@app.get('/')
async def index(response: Response):
response.set_cookie('key', 'value', secure=True)
return {"message": "Hello world!"}
----
include::../see.adoc[]
ifdef::env-github,rspecator-view[]