Description

This detector identifies path traversal vulnerabilities in Starlette web applications where user-controlled input can be used to write files to arbitrary locations on the filesystem. This occurs when file write operations use unsanitized input that could contain directory traversal sequences like "../" allowing attackers to write files outside intended directories, potentially leading to code execution or system compromise.

Detection Strategy

• Checks if the code imports the Starlette web framework library

• Excludes analysis when FastAPI is imported (handled by separate detector)

• Identifies file write operations and their destination parameters in the code

• Traces data flow from user input sources to file write destinations using taint analysis

• Reports vulnerability when user-controlled data flows to file write operations without proper path validation or sanitization

Vulnerable code example

from pathlib import Path
from starlette.requests import Request
import shutil
import os

async def upload_file(request: Request):
    filename = request.query_params["filename"]
    path = Path("uploads") / filename...

✅ Secure code example

from pathlib import Path
from starlette.requests import Request
from starlette.exceptions import HTTPException
import shutil
import os

async def upload_file(request: Request):
    filename = request.query_params["filename"]...