Description

Detects uncontrolled format string vulnerabilities in Python Tornado web applications where user input could be used as a format string in self.write() calls. This can lead to information disclosure or potential code execution if an attacker can control the format string arguments.

Detection Strategy

• Checks if the Tornado web framework is imported in the Python code

• Identifies calls to self.write() method in Tornado request handlers

• Analyzes if the string argument passed to self.write() contains format string specifiers (%s, %d, etc.) that could be controlled by user input

• Reports a vulnerability when format strings in self.write() calls are derived from untrusted sources

Vulnerable code example

import tornado.web
from string import Formatter

class VulnerableHandler(tornado.web.RequestHandler):
    def post(self):
        # User-controlled input from request parameter
        user_pattern = self.get_argument("pattern")
        fmt = Formatter()...

✅ Secure code example

import tornado.web

class SecureHandler(tornado.web.RequestHandler):
    def post(self):
        # User input is only used as value, not as format string
        user_input = self.get_argument("pattern")
        
        # SAFE: Format string is hardcoded, user input is only a parameter...