Description

Detects when Flask applications are configured to run in debug mode in production environments. Debug mode exposes sensitive internal information and allows remote code execution through the debugger, making it a critical security risk if enabled in production.

Detection Strategy

• Looks for Flask application run configurations using 'app.run'

• Checks if debug parameter is explicitly set to True in the run configuration

• Reports a vulnerability when debug mode is enabled in Flask application code

• Focuses on direct assignments like 'app.run(debug=True)' in the application code

Vulnerable code example

from flask import Flask

app = Flask(__name__)

DEBUG_MODE = True  # Dangerous: Debug mode should never be enabled in production

app.run(debug=DEBUG_MODE)  # Vulnerable: Exposes debugger with code execution

✅ Secure code example

from flask import Flask
from typing import Final

app: Flask = Flask(__name__)

DEBUG_MODE: Final = False  # Security: Debug mode disabled for production

@app.route("/")...