Python: Model FastAPI requests #18318
Conversation
Co-authored-by: Joe Farebrother <[email protected]>
Co-authored-by: Joe Farebrother <[email protected]>
There was a problem hiding this comment.
Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.
Files not reviewed (1)
- python/ql/lib/semmle/python/frameworks/Starlette.qll: Language not supported
Comments suppressed due to low confidence (4)
python/ql/test/library-tests/frameworks/fastapi/taint_test.py:213
- The taint annotation is missing for the data returned by
request.form().getlist("key"). Ensure that this case is covered by the taint analysis.
await request.form().getlist("key"), // $ MISSING: tainted
python/ql/test/library-tests/frameworks/fastapi/taint_test.py:214
- The taint annotation is missing for the first element of the list returned by
request.form().getlist("key"). Ensure that this case is covered by the taint analysis.
await request.form().getlist("key")[0], // $ MISSING: tainted
python/ql/test/library-tests/frameworks/fastapi/taint_test.py:216
- The taint annotation is missing for the filename of the file returned by
request.form()["file"]. Ensure that this case is covered by the taint analysis.
await request.form()["file"].filename, // $ MISSING: tainted
python/ql/test/library-tests/frameworks/fastapi/taint_test.py:217
- The taint annotation is missing for the filename of the first file in the list returned by
request.form().getlist("file"). Ensure that this case is covered by the taint analysis.
await request.form().getlist("file")[0].filename, // $ MISSING: tainted
Tip: If you use Visual Studio Code, you can request a review from Copilot before you push from the "Source Control" tab. Learn more
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| override DataFlow::Node getInstance() { result = instance() } | ||
|
|
||
| override string getAttributeName() { result in ["cookies"] } |
Check warning
Code scanning / CodeQL
Singleton set literal Warning
| await request.form().getlist("key"), # $ MISSING: tainted | ||
| await request.form().getlist("key")[0], # $ MISSING: tainted | ||
| # data in the form could be an starlette.datastructures.UploadFile | ||
| await request.form()["file"].filename, # $ MISSING: tainted | ||
| await request.form().getlist("file")[0].filename, # $ MISSING: tainted |
There was a problem hiding this comment.
For my understanding: These are missing because we don't track flow from the result of form() through to its own properties?
There was a problem hiding this comment.
Yes, we don't have taint-steps to attribute reads by default 👍 We would need to model the specific attribute-flow we wanted for multidict and uploaded files, which we haven't done yet.
| * Taint propagation for `starlette.requests.Request`. | ||
| */ | ||
| private class InstanceTaintSteps extends InstanceTaintStepsHelper { | ||
| InstanceTaintSteps() { this = "starlette.requests.Request" } |
There was a problem hiding this comment.
For my understanding: This would also apply to fastapi.Request but you're just choosing one qualified name to represent the class right?
There was a problem hiding this comment.
yes, this class is like the old string-based dataflow configurations, so it just needs a unique string to not have cross-talk.
python/ql/lib/change-notes/2024-12-18-fastapi-request-modeling.md
Outdated
Show resolved
Hide resolved
| from fastapi import Request | ||
|
|
||
|
|
||
| assert Request == starlette.requests.Request |
There was a problem hiding this comment.
Does this assert tell the analysis (type tracking?) that these types are equal?
There was a problem hiding this comment.
no, it's purely for humans reading the test-file to highlight the fact that they are indeed the same class.
There was a problem hiding this comment.
(we just adjusted a copy of the websocket modeling, which did the same)
There was a problem hiding this comment.
Non-blocking question: If we accidentally dropped either fastapi or starlette from the union in classRef, this test would still pass right? Would we want separate test code paths for the two ways of obtaining the Request type?
There was a problem hiding this comment.
If we accidentally dropped either fastapi or starlette from the union in
classRef, this test would still pass right?
yep. that asssert has no impact on the analysis, and could have been a comment.
Would we want separate test code paths for the two ways of obtaining the
Requesttype?
If we wanted 100% test-coverage of our modeling, then yes. My personal opinion is that we're getting into the realm of diminishing returns of doing so, so I didn't bother.
Co-authored-by: Aditya Sharad <[email protected]>
| from fastapi import Request | ||
|
|
||
|
|
||
| assert Request == starlette.requests.Request |
There was a problem hiding this comment.
Non-blocking question: If we accidentally dropped either fastapi or starlette from the union in classRef, this test would still pass right? Would we want separate test code paths for the two ways of obtaining the Request type?
Pull Request checklist
All query authors
.qhelp. See the documentation in this repository.Internal query authors only
.ql,.qll, or.qhelpfiles. See the documentation (internal access required).