rspec/rules/S5144/python/rule.adoc
2020-06-30 17:16:12 +02:00

31 lines
580 B
Plaintext

include::../description.adoc[]
== Noncompliant Code Example
----
from flask import request
import urllib
@app.route('/proxy')
def proxy():
url = request.args["url"]
return urllib.request.urlopen(url).read() # Noncompliant
----
== Compliant Solution
----
from flask import request
import urllib
DOMAINS_WHITELIST = ['domain1.com', 'domain2.com']
@app.route('/proxy')
def proxy():
url = request.args["url"]
if urllib.parse.urlparse(url).hostname in DOMAINS_WHITELIST:
return urllib.request.urlopen(url).read() # Compliant
----
include::../see.adoc[]