Description

This detector identifies path traversal vulnerabilities in file deletion operations within Starlette web applications. The vulnerability occurs when user-controlled input is used to construct file paths for deletion without proper validation, potentially allowing attackers to delete arbitrary files outside the intended directory structure.

Detection Strategy

• Check if the code imports Starlette library but not FastAPI (since FastAPI has separate handling)

• Identify file deletion operations (like os.remove, os.unlink, pathlib.Path.unlink) in the codebase

• Trace data flow from user input sources (request parameters, form data, URL paths) to deletion operations

• Flag deletion operations where user-controlled data reaches the file path parameter without proper sanitization or validation

• Verify the taint flow follows Starlette-specific patterns for handling web requests and parameters

Vulnerable code example

import os
import shutil
from pathlib import Path
from starlette.requests import Request

BASE_DIR = Path("/var/www/app/uploads").resolve()

async def vulnerable_remove(request: Request):...

✅ Secure code example

import os
import shutil
from pathlib import Path
from starlette.requests import Request
from starlette.responses import JSONResponse, PlainTextResponse

BASE_DIR = Path("/var/www/app/uploads").resolve()
...