Description

This detector identifies path traversal vulnerabilities in Flask applications where user-controlled input is passed to file operations without proper sanitization. Path traversal attacks allow attackers to access files outside the intended directory by using sequences like "../" to navigate up directory structures, potentially exposing sensitive system files or application data.

Detection Strategy

• The detector only runs when Flask library is imported in the Python code

• It examines file operation functions (like open(), with open(), file read/write operations) to identify potential file path sinks

• For each file operation, it traces back the file path parameter to determine its data source

• A vulnerability is reported when the file path comes from user-controllable input (HTTP requests, form data, URL parameters, etc.) without proper validation or sanitization

• The detector specifically looks for Flask taint sources that flow into file operations, indicating that external user input could manipulate file paths

Vulnerable code example

from flask import Flask, request
from pathlib import Path

app = Flask(__name__)

@app.route("/read")
def vulnerable_path_traversal():
    filename = request.args.get("file")...

✅ Secure code example

from flask import Flask, request
from pathlib import Path
from werkzeug.utils import secure_filename
import os

app = Flask(__name__)

BASE_DIRECTORY = "/var/files"...